CVE-2011-0997 dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a h...
HighCVSS 7.5
EPSS 84.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is provided to dhclient-script.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| isc dhcp | = 3.0 | No fix listed |
| isc dhcp | = 3.0.1 | No fix listed |
| isc dhcp | = 3.0.1-rc1 | No fix listed |
| isc dhcp | = 3.0.1-rc10 | No fix listed |
| isc dhcp | = 3.0.1-rc11 | No fix listed |
| isc dhcp | = 3.0.1-rc12 | No fix listed |
| isc dhcp | = 3.0.1-rc13 | No fix listed |
| isc dhcp | = 3.0.1-rc14 | No fix listed |
| isc dhcp | = 3.0.1-rc2 | No fix listed |
| isc dhcp | = 3.0.1-rc5 | No fix listed |
| isc dhcp | = 3.0.1-rc6 | No fix listed |
| isc dhcp | = 3.0.1-rc7 | No fix listed |
| isc dhcp | = 3.0.1-rc8 | No fix listed |
| isc dhcp | = 3.0.1-rc9 | No fix listed |
| isc dhcp | = 3.0.2 | No fix listed |
| isc dhcp | = 3.0.2-b1 | No fix listed |
| isc dhcp | = 3.0.2-rc1 | No fix listed |
| isc dhcp | = 3.0.2-rc2 | No fix listed |
| isc dhcp | = 3.0.2-rc3 | No fix listed |
| isc dhcp | = 3.0.3 | No fix listed |
| isc dhcp | = 3.0.3-b1 | No fix listed |
| isc dhcp | = 3.0.3-b2 | No fix listed |
| isc dhcp | = 3.0.3-b3 | No fix listed |
| isc dhcp | = 3.0.4 | No fix listed |
| isc dhcp | = 3.0.4-b1 | No fix listed |
Show 44 more
| Product | Affected versions | Fixed in |
|---|---|---|
| isc dhcp | = 3.0.4-b2 | No fix listed |
| isc dhcp | = 3.0.4-b3 | No fix listed |
| isc dhcp | = 3.0.4-rc1 | No fix listed |
| isc dhcp | = 3.0.5 | No fix listed |
| isc dhcp | = 3.0.5-rc1 | No fix listed |
| isc dhcp | = 3.0.6-rc1 | No fix listed |
| isc dhcp | = 3.1-esv | No fix listed |
| isc dhcp | = 3.1.0 | No fix listed |
| isc dhcp | = 3.1.0-a1 | No fix listed |
| isc dhcp | = 3.1.0-a2 | No fix listed |
| isc dhcp | = 3.1.0-a3 | No fix listed |
| isc dhcp | = 3.1.0-b1 | No fix listed |
| isc dhcp | = 3.1.0-b2 | No fix listed |
| isc dhcp | = 3.1.0-rc1 | No fix listed |
| isc dhcp | = 3.1.1-rc1 | No fix listed |
| isc dhcp | = 3.1.1-rc2 | No fix listed |
| isc dhcp | = 3.1.2 | No fix listed |
| isc dhcp | = 3.1.2-b1 | No fix listed |
| isc dhcp | = 3.1.2-rc1 | No fix listed |
| isc dhcp | = 3.1.3 | No fix listed |
| isc dhcp | = 3.1.3-b1 | No fix listed |
| isc dhcp | = 3.1.3-rc1 | No fix listed |
| isc dhcp | = 4.1-esv | No fix listed |
| isc dhcp | = 4.1-esv-rc1 | No fix listed |
| isc dhcp | = 4.2.0 | No fix listed |
| isc dhcp | = 4.2.0-a1 | No fix listed |
| isc dhcp | = 4.2.0-a2 | No fix listed |
| isc dhcp | = 4.2.0-b1 | No fix listed |
| isc dhcp | = 4.2.0-b2 | No fix listed |
| isc dhcp | = 4.2.0-p1 | No fix listed |
| isc dhcp | = 4.2.0-rc1 | No fix listed |
| isc dhcp | = 4.2.1 | No fix listed |
| isc dhcp | = 4.2.1-b1 | No fix listed |
| isc dhcp | = 4.2.1-rc1 | No fix listed |
| debian linux | = 5.0 | No fix listed |
| debian linux | = 6.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
| Canonical Ubuntu Linux | = 9.10 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 10.10 | No fix listed |
| debian/isc-dhcp(Debian:12) | < 4.1.1-P1-16.1 | 4.1.1-P1-16.1 |
| debian/isc-dhcp(Debian:13) | < 4.1.1-P1-16.1 | 4.1.1-P1-16.1 |
References
- kb.juniper.net third-party-advisory
- FEDORA-2011-4897 mailing-list third-party-advisory vendor-advisory
- FEDORA-2011-4934 mailing-list third-party-advisory vendor-advisory
- HPSBMU02752 mailing-list third-party-advisory vendor-advisory
- 44037 third-party-advisory
- 44048 third-party-advisory
- 44089 third-party-advisory
- 44090 third-party-advisory
- 44103 third-party-advisory
- 44127 third-party-advisory
- 44180 third-party-advisory
- GLSA-201301-06 third-party-advisory vendor-advisory
- 1025300 third-party-advisory vdb-entry
- SSA:2011-097-01 third-party-advisory vendor-advisory
- DSA-2216 third-party-advisory vendor-advisory
- DSA-2217 third-party-advisory vendor-advisory
- VU#107886 third-party-advisory us-government-resource
- MDVSA-2011:073 third-party-advisory vendor-advisory
- 71493 broken-link vdb-entry
- RHSA-2011:0428 third-party-advisory vendor-advisory
- RHSA-2011:0840 third-party-advisory vendor-advisory
- 47176 third-party-advisory vdb-entry
- USN-1108-1 third-party-advisory vendor-advisory
- ADV-2011-0879 permissions-required vdb-entry
- ADV-2011-0886 permissions-required vdb-entry
- ADV-2011-0909 permissions-required vdb-entry
- ADV-2011-0915 permissions-required vdb-entry
- ADV-2011-0926 permissions-required vdb-entry
- ADV-2011-0965 permissions-required vdb-entry
- ADV-2011-1000 permissions-required vdb-entry
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- iscdhcp-dhclient-command-execution(66580) third-party-advisory vdb-entry
- oval:org.mitre.oval:def:12812 signature third-party-advisory vdb-entry
- 37623 exploit third-party-advisory vdb-entry
- www.isc.org patch vendor-advisory
- Debian Security Tracker CVE-2011-0997 vendor-advisory
- bugs.debian.org issue-tracking