CVE-2015-8605

What it actually does

Improper validation of the length field in a UDP IPv4 packet allows a remote attacker to trigger an application crash in the DHCP server process.

Why it matters to the business

Adjacent attackers can interrupt IP address assignment services, causing widespread client connectivity loss; the high EPSS score indicates elevated likelihood of exploitation despite the vulnerability's age and lack of ransomware association.

How an attack unfolds

An unauthenticated attacker on the local network segment crafts and sends a single malformed DHCP packet containing an invalid length value; the server fails to handle the input safely and terminates.

How to fix it

Upgrade ISC DHCP to 4.1-ESV-R12-P1 or 4.3.3-P1 (or later releases in each branch); apply vendor patches for Sophos UTM, Debian, and Ubuntu packages; disable untrusted adjacent network access where feasible.

How to confirm the fix worked

Verify installed dhcpd version against the fixed releases; perform controlled packet fuzzing or review source for length checks; confirm service remains stable under malformed input.

Typical attack path

1. Identify reachable DHCP servers on the adjacent network
2. Craft a UDP IPv4 packet with an invalid length field
3. Transmit the packet to the DHCP service port
4. Observe service crash and denial of address assignment

How to detect it

Search DHCP server logs and system crash reports for abrupt terminations coinciding with unusual UDP traffic; examine packet captures for malformed DHCP messages targeting port 67/68.

What your security team should do

• Prioritize patching all ISC DHCP instances given the 8% EPSS increase and 3920-day exposure window
• Restrict DHCP traffic to trusted network segments
• Enable process monitoring and automatic restart for dhcpd
• Review downstream package lists for affected Debian/Ubuntu/Sophos deployments