National Cyber Awareness System

Vulnerability Summary for CVE-2011-0997

Overview

dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is provided to dhclient-script.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#107886

Name: VU#107886

Hyperlink:http://www.kb.cert.org/vuls/id/107886

External Source: CONFIRM

Name: https://www.isc.org/software/dhcp/advisories/cve-2011-0997

Type: Advisory; Patch Information

Hyperlink:https://www.isc.org/software/dhcp/advisories/cve-2011-0997

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=689832

Type: Patch Information

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=689832

External Source: XF

Name: iscdhcp-dhclient-command-execution(66580)

Hyperlink:http://xforce.iss.net/xforce/xfdb/66580

External Source: VUPEN

Name: ADV-2011-1000

Hyperlink:http://www.vupen.com/english/advisories/2011/1000

External Source: VUPEN

Name: ADV-2011-0965

Hyperlink:http://www.vupen.com/english/advisories/2011/0965

External Source: VUPEN

Name: ADV-2011-0926

Hyperlink:http://www.vupen.com/english/advisories/2011/0926

External Source: VUPEN

Name: ADV-2011-0915

Hyperlink:http://www.vupen.com/english/advisories/2011/0915

External Source: VUPEN

Name: ADV-2011-0909

Hyperlink:http://www.vupen.com/english/advisories/2011/0909

External Source: VUPEN

Name: ADV-2011-0886

Hyperlink:http://www.vupen.com/english/advisories/2011/0886

External Source: VUPEN

Name: ADV-2011-0879

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2011/0879

External Source: UBUNTU

Name: USN-1108-1

Hyperlink:http://www.ubuntu.com/usn/USN-1108-1

External Source: BID

Name: 47176

Hyperlink:http://www.securityfocus.com/bid/47176

External Source: REDHAT

Name: RHSA-2011:0840

Hyperlink:http://www.redhat.com/support/errata/RHSA-2011-0840.html

External Source: REDHAT

Name: RHSA-2011:0428

Hyperlink:http://www.redhat.com/support/errata/RHSA-2011-0428.html

External Source: OSVDB

Name: 71493

Hyperlink:http://www.osvdb.org/71493

External Source: MANDRIVA

Name: MDVSA-2011:073

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2011:073

External Source: DEBIAN

Name: DSA-2217

Hyperlink:http://www.debian.org/security/2011/dsa-2217

External Source: DEBIAN

Name: DSA-2216

Hyperlink:http://www.debian.org/security/2011/dsa-2216

External Source: SLACKWARE

Name: SSA:2011-097-01

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.593345

External Source: SECTRACK

Name: 1025300

Hyperlink:http://securitytracker.com/id?1025300

External Source: SECUNIA

Name: 44180

Hyperlink:http://secunia.com/advisories/44180

External Source: SECUNIA

Name: 44127

Hyperlink:http://secunia.com/advisories/44127

External Source: SECUNIA

Name: 44103

Hyperlink:http://secunia.com/advisories/44103

External Source: SECUNIA

Name: 44090

Hyperlink:http://secunia.com/advisories/44090

External Source: SECUNIA

Name: 44089

Hyperlink:http://secunia.com/advisories/44089

External Source: SECUNIA

Name: 44048

Hyperlink:http://secunia.com/advisories/44048

External Source: SECUNIA

Name: 44037

Type: Advisory

Hyperlink:http://secunia.com/advisories/44037

External Source: OVAL

Name: oval:org.mitre.oval:def:12812

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12812

External Source: HP

Name: SSRT100802

Hyperlink:http://marc.info/?l=bugtraq&m=133226187115472&w=2

External Source: HP

Name: HPSBMU02752

Hyperlink:http://marc.info/?l=bugtraq&m=133226187115472&w=2

External Source: FEDORA

Name: FEDORA-2011-4934

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058279.html

External Source: FEDORA

Name: FEDORA-2011-4897

Hyperlink:http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057888.html

References to Check Content

Identifier:oval:org.mitre.oval:def:12812

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:12812