Risk of DoS on DHCP daemon

Advisory ID CVE Number Date discovered Severity Advisory revision
STORM-2023-023 CVE-2023-44453 06/26/2023 medium v2

Vulnerability details

An issue was discovered in the Direct Host Control Protocol service in Stormshield Network Security (SNS) products.

Impacted products

ProductsSeverityDetail
Stormshield Network Security medium SNS is impacted

Revisions

Version Date Description
v1 06/30/2023 Reserved Publication
v2 02/13/2024 Updated and disclosed


Stormshield Network Security

CVSS v3.1 Overall Score: 4.2      

Analysis

Impacted version

Flooding the SNS with specific dhcp requests can lead to a denial of service.
  • SNS 1.1.0 to 3.7.39
  • SNS 3.11.0 to 3.11.27
  • SNS 4.0.0 to 4.3.22
  • SNS 4.4.0 to 4.6.10
  • SNS 4.7.0 to 4.7.1

Workaround solution

Solution

There is no workaround solution.

The following versions fix this vulnerability:

  • 3.7.40
  • 3.11.28
  • 4.3.23
  • 4.6.11
  • 4.7.2


Attack Vector Attack Complexity Privileges Required User Interaction Scope Confidentiality Impact Integrity Impact Availability impact
Adjacent Network Low None None Unchanged None None High
CVSS Base score: 6.5 CVSS Vector: (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Exploit Code Maturity Remediation Level Report Confidence
Proof of concept code Official fix Confirmed
CVSS Temporal score: 5.9 CVSS Vector: (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C)
Confidentiality Requirement (CR) Integrity Requirement (IR) Availability Requirement (AR)
Low Low Low
CVSS Environmental score: 4.2 CVSS Vector: (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C/CR:L/IR:L/AR:L/MAV:X/MAC:X/MPR:X/MUI:X/MS:X/MC:X/MI:X/MA:X)