Gentoo: dhcpcd input validation vulnerability
A lack of input validation on an external script may make it possible for commands injected by a malicious DHCP server to be executed through the use of shell metacharacters such a...
Summary
- -------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200301-3 - -------------------------------------------------------------------- DATE : 2003-01-05 00:01 UTC
- --------------------------------------------------------------------
When assigning an IP address to a network interface, dhcpcd may execute an external script, '/sbin/dhcpd-.exe'. This is an optional configuration that must be setup manually on Gentoo Linux systems by copying the script into /sbin/.
The script 'dhcpcd-.exe' uses values from '/var/lib/dhcpcd/dhcpcd- .info', which originate from the DHCP server. A lack of input validation on this data may make it possible for commands injected by a malicious DHCP server to be executed through the use of shell metacharacters such as ';' and '|'. These commands may run with root privileges.
More information is available at
SOLUTION
It is recommended that all Gentoo Linux users who are running net-misc/dhcpcd-1.3.20_p0-r1 or earlier update their systems as follows:
emerge rsync emerge dhcpcd emerge clean
- -------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at - --------------------------------------------------------------------
Resolution
References
Availability
Concerns
Severity
PACKAGE : dhcpcd
SUMMARY : remote command execution
EXPLOIT : remote
