# MA-558.012016: MyCERT Advisory - ISC Releases Security Updates

**Date:** 15 Jan 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-558.012016  
**Advisory ID:** MA-558.012016

---

####
**1.0 Introduction**
Internet Systems Consortium (ISC) has released security updates to address a vulnerability in the ISC Dynamic Host Configuration Protocol (DHCP) software.
Users and administrators are encouraged to review ISC Knowledge Base Article AA-01334 and apply the necessary updates.
**2.0 Impact**
Exploitation of this vulnerability may allow a remote attacker to cause a denial-of-service condition.
**3.0 Affected Products**
Version affected:
•    4.0.x, 4.1.x, 4.2.x,
•    4.1-ESV -> 4.1-ESV-R12,
•    4.3.0->4.3.3.
•    3.x may also be affected but has not been tested.
**4.0 Recommendations**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products:
4.1 Upgrade to the patched release most closely 
•    These can all be downloaded from:
<http://www.isc.org/downloads>
•    Available updates include:
DHCP version 4.1-ESV-R12-P1
DHCP version 4.3.3-P1
4.2 Workarounds:
Following the advice from:
<https://kb.isc.org/article/AA-00573/31/Securing-Your-Network-From-DHCP-Risks.html>
•    can substantially reduce the risk by limiting the exposure of a DHCP server to "controlled" networks and clients.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#d6b5afb4b3a4efefef96b5afb4b3a4a5b3b5a3a4bfa2aff8bbaf) or [[email protected]](/cdn-cgi/l/email-protection#3b5642585e494f7b5642585e494f1554495c155642) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0     References**
•    ISC Releases Security Updates:
<https://www.us-cert.gov/ncas/current-activity/2016/01/12/ISC-Releases-Security-Updates>
•    CVE-2015-8605: UDP payload length not properly checked:    
<https://kb.isc.org/article/AA-01334>
•    ESB-2016.0092 - [Win][UNIX/Linux] DHCP: Denial of service - Remote/unauthenticated:
[https://www.auscert.org.au/render.html?it=29914](https://www.auscert.org.au/render.html?it=29914 )