full-disclosure - GLSA: dhcpcd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: aliz at gentoo.org (Daniel Ahlberg)
Subject: GLSA:  dhcpcd

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - --------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200301-3
- - --------------------------------------------------------------------

PACKAGE : dhcpcd
SUMMARY : remote command execution
DATE    : 2003-01-05 00:01 UTC
EXPLOIT : remote

- - --------------------------------------------------------------------

When assigning an IP address to a network interface, dhcpcd may 
execute an external script, '/sbin/dhcpd-<interface>.exe'. 
This is an optional configuration that must be setup manually on 
Gentoo Linux systems by copying the script 
into /sbin/. 

The script 'dhcpcd-<interface>.exe' uses values from 
'/var/lib/dhcpcd/dhcpcd-<interface>.info', which originate from the 
DHCP server. A lack of input validation on this data may make it 
possible for commands injected by a malicious DHCP server to be 
executed through the use of shell metacharacters such as ';' and '|'. 
These commands may run with root privileges.

More information is available at
http://online.securityfocus.com/bid/6200/info/

SOLUTION

It is recommended that all Gentoo Linux users who are running
net-misc/dhcpcd-1.3.20_p0-r1 or earlier update their systems as 
follows:

emerge rsync
emerge dhcpcd
emerge clean

- - --------------------------------------------------------------------
aliz@...too.org - GnuPG key is available at www.gentoo.org/~aliz
- - --------------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+F3zufT7nyhUpoZMRAm+hAKCzOXX6yIYWnhHXWYclGaTAmvx5iQCffolq
/YhKi+P23DLiTsUoL9l5B98=
=sCso
-----END PGP SIGNATURE-----