dhcpcd before 5.2.12 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message.

A rogue dhcp server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the dhcp client needs to sanitize the host name offered by the server (CVE-2011-0996).

Note this update is actually just a re-release of the previous one.
The security fix made dhcpcd crash if the DHCP server sent a SIP option that was not decodable.

A rogue dhcp server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the dhcp client needs to sanitize the host name offered by the server (CVE-2011-0996).
This update also fixes packet handling with xen partial UDP checksums.

The remote host is affected by the vulnerability described in GLSA-201301-04 (dhcpcd: Arbitrary code execution)

    A vulnerability has been discovered in dhcpcd. Please review the CVE       identifier referenced below for details.
  Impact :

    The vulnerability might allow an attacker to execute arbitrary code on       the DHCP client.
  Workaround :

    There is no known workaround at this time.

A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by the server. (CVE-2011-0996)

Note: this is a re-release of the security update. The previous update caused the DHCP client to reject domain names with spaces. That behavior is RFC conform but in practice some DHCP servers use the domain name field to set the DNS search list. Spaces are allowed again now but future products may enforce RFC compliance again. DHCP server administrators are advised to check their server setup.

A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by the server. (CVE-2011-0996)

New dhcpcd packages are available for Slackware 13.0, 13.1, 13.37, and -current to fix security issues.

This update fixes the following security issue :

A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by the server (CVE-2011-0996).

Note this update is actually just a re-release of the previous one.
The security fix made dhcpcd crash if the DHCP server sent a SIP option that was not decodable. This update also allows spaces in the domain name option again as some DHCP servers abuse the option as DNS search list.

This update fixes the following security issue :

A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by the server (CVE-2011-0996).

This update also fixes the following non-security issues :

  - 564441: e1000 and dhcpd hickup

  - 565030: dhcpcd not using router component of dhcp server     option 33 (Static Route)

  - 574938: Sysem Update Fails to deploy to Primary serve.

  - 577402: dhcpcp with Patch bnc#565030 has netlink error     with /32 netmask

  - 601704: dhcpcd: ignores link carrier and does not     retransmit

  - 654649: dhcpcd ignores -G (--nogateway) option and sets     default route

  - 657402: dhcpcd sends RENEWAL as ethernet broadcast     instead of unicast

  - 668194: dhcp client not working properly in Xen domU due     to partial checksum offload

A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by the server. (CVE-2011-0996)

Note this update is actually just a re-release of the previous one.
The security fix made dhcpcd crash if the dhcp server sent a SIP option that was not decodable.

This update also fixes the following non-security issues :

  - 564441: e1000 and dhcpd hickup

  - 579438: endless loop after adding wlan usb stick (with     dhcp ip lease time infinity)

  - 654649: dhcpcd ignores -G (--nogateway) option and sets     default route

  - 657402: dhcpcd sends RENEWAL as ethernet broadcast     instead of unicast

  - 668194: dhcp client not working properly in Xen domU due     to partial checksum offload

  - 672038: dhcpcd sends RENEWAL as ethernet broadcast     instead of unicast

A rogue DHCP server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the DHCP client needs to sanitize the host name offered by the server. (CVE-2011-0996)

This update also fixes the following non-security issues :

  - 564441: e1000 and dhcpd hickup

  - 579438: endless loop after adding wlan usb stick (with     dhcp ip lease time infinity)

  - 654649: dhcpcd ignores -G (--nogateway) option and sets     default route

  - 657402: dhcpcd sends RENEWAL as ethernet broadcast     instead of unicast

  - 668194: dhcp client not working properly in Xen domU due     to partial checksum offload

  - 672038: dhcpcd sends RENEWAL as ethernet broadcast     instead of unicast

ID	Name	Product	Family	Severity
75817	openSUSE Security Update : dhcpcd (openSUSE-SU-2011:0385-1)	Nessus	SuSE Local Security Checks	medium
75816	openSUSE Security Update : dhcpcd (openSUSE-SU-2011:0352-1)	Nessus	SuSE Local Security Checks	medium
75469	openSUSE Security Update : dhcpcd (openSUSE-SU-2011:0385-1)	Nessus	SuSE Local Security Checks	medium
63438	GLSA-201301-04 : dhcpcd: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
57184	SuSE 10 Security Update : dhcpcd (ZYPP Patch Number 7453)	Nessus	SuSE Local Security Checks	medium
57183	SuSE 10 Security Update : dhcpcd (ZYPP Patch Number 7433)	Nessus	SuSE Local Security Checks	medium
55736	Slackware 13.0 / 13.1 / 13.37 / current : dhcpcd (SSA:2011-210-02)	Nessus	Slackware Local Security Checks	medium
53708	openSUSE Security Update : dhcpcd (openSUSE-SU-2011:0385-1)	Nessus	SuSE Local Security Checks	medium
53707	openSUSE Security Update : dhcpcd (openSUSE-SU-2011:0342-1)	Nessus	SuSE Local Security Checks	medium
53636	SuSE9 Security Update : dhcp6 (YOU Patch Number 12697)	Nessus	SuSE Local Security Checks	high
53501	SuSE 11.1 Security Update : dhcpcd (SAT Patch Number 4389)	Nessus	SuSE Local Security Checks	medium
53359	SuSE 10 Security Update : dhcpcd (ZYPP Patch Number 7452)	Nessus	SuSE Local Security Checks	medium
53357	SuSE 11.1 Security Update : dhcpcd (SAT Patch Number 4316)	Nessus	SuSE Local Security Checks	medium
53355	SuSE9 Security Update : dhcpcd (YOU Patch Number 12699)	Nessus	SuSE Local Security Checks	high
53354	SuSE9 Security Update : dhcp (YOU Patch Number 12698)	Nessus	SuSE Local Security Checks	high
53317	SuSE 10 Security Update : dhcpcd (ZYPP Patch Number 7432)	Nessus	SuSE Local Security Checks	medium
53312	SuSE9 Security Update : dhcpcd (YOU Patch Number 12696)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2011-0996

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

high

high

medium

high