full-disclosure - ISC DHCP Client [3.0.x to 4.2.x] Arbitrary Command Execution (CVE-2011-0997)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <976926425.9534761302112918693.JavaMail.root@zcs-mbs03.it.mtu.edu>
Date: Wed, 6 Apr 2011 14:01:58 -0400 (EDT)
From: Ryan Sears <rdsears@....edu>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: ISC DHCP Client [3.0.x to 4.2.x] Arbitrary
 Command Execution (CVE-2011-0997)

Hey guys,

It was recently discovered (NOT by myself) that the ISC dhclient was vulnerable to certain shell metacharacters in the hostname parameter specified by *any* DHCP server, causing it to potentially run arbitrary commands as root. I haven't seen anything else on it here, so I figured I'd make everyone aware. 

There's only one real phrase that comes to mind => WTF?

https://www.isc.org/software/dhcp/advisories/cve-2011-0997

http://www.h-online.com/security/news/item/DHCP-client-allows-shell-command-injection-1222805.html

Ryan

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/