CVE-2011-0996 dhcpcd before 5.2.12 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message.
MediumCVSS 6.8
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
dhcpcd before 5.2.12 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| roy marples dhcpcd | <= 5.2.10 | No fix listed |
References
- [dhcpcd-discuss] 20110406 [CVE-2011-996] dhcpcd does not strip or escape shell meta characters mailing-list
- roy.marples.name patch
- roy.marples.name
- 44070 third-party-advisory vendor-advisory
- GLSA-201301-04 vendor-advisory
- 47272 vdb-entry
- bugzilla.novell.com
- dhcpcd-response-command-execution(66641) vdb-entry
- Debian Security Tracker CVE-2011-0996 vendor-advisory