| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20030105003146.D191C33806@mail1.tamperd.net> From: aliz at gentoo.org (Daniel Ahlberg) Subject: GLSA: dhcpcd -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - -------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200301-3 - - -------------------------------------------------------------------- PACKAGE : dhcpcd SUMMARY : remote command execution DATE : 2003-01-05 00:01 UTC EXPLOIT : remote - - -------------------------------------------------------------------- When assigning an IP address to a network interface, dhcpcd may execute an external script, '/sbin/dhcpd-<interface>.exe'. This is an optional configuration that must be setup manually on Gentoo Linux systems by copying the script into /sbin/. The script 'dhcpcd-<interface>.exe' uses values from '/var/lib/dhcpcd/dhcpcd-<interface>.info', which originate from the DHCP server. A lack of input validation on this data may make it possible for commands injected by a malicious DHCP server to be executed through the use of shell metacharacters such as ';' and '|'. These commands may run with root privileges. More information is available at http://online.securityfocus.com/bid/6200/info/ SOLUTION It is recommended that all Gentoo Linux users who are running net-misc/dhcpcd-1.3.20_p0-r1 or earlier update their systems as follows: emerge rsync emerge dhcpcd emerge clean - - -------------------------------------------------------------------- aliz@...too.org - GnuPG key is available at www.gentoo.org/~aliz - - -------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQE+F3zufT7nyhUpoZMRAm+hAKCzOXX6yIYWnhHXWYclGaTAmvx5iQCffolq /YhKi+P23DLiTsUoL9l5B98= =sCso -----END PGP SIGNATURE-----
Powered by blists - more mailing lists