Published: 08/04/2011 Updated: 01/04/2020

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

dhclient in ISC DHCP 3.0.x up to and including 4.2.x prior to 4.2.1-P1, 3.1-ESV prior to 3.1-ESV-R1, and 4.1-ESV prior to 4.1-ESV-R2 allows remote malicious users to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is provided to dhclient-script.

Vulnerable Product	Search on Vulmon	Subscribe to Product
isc dhcp 3.0
isc dhcp 3.0.1
isc dhcp 3.0.2
isc dhcp 3.0.3
isc dhcp 3.0.4
isc dhcp 3.0.5
isc dhcp 3.0.6
isc dhcp 3.1-esv
isc dhcp 3.1.0
isc dhcp 3.1.1
isc dhcp 3.1.2
isc dhcp 3.1.3
isc dhcp 4.1-esv
isc dhcp 4.2.0
isc dhcp 4.2.1
debian debian linux 5.0
debian debian linux 6.0
debian debian linux 7.0
canonical ubuntu linux 6.06
canonical ubuntu linux 8.04
canonical ubuntu linux 9.10
canonical ubuntu linux 10.04
canonical ubuntu linux 10.10

Debian Bug report logs - #621099 isc-dhcp-client: CVE-2011-0997 Package: isc-dhcp-client; Maintainer for isc-dhcp-client is Debian ISC DHCP Maintainers <isc-dhcp@packagesdebianorg>; Source for isc-dhcp-client is src:isc-dhcp (PTS, buildd, popcon) Reported by: Christoph Anton Mitterer <calestyo@scientianet> Date: W ...

An attacker’s DHCP server could send crafted responses to your computer and cause it to run programs as root ...

Sebastian Krahmer and Marius Tomaschewski discovered that dhclient of isc-dhcp, a DHCP client, is not properly filtering shell meta-characters in certain options in DHCP server responses These options are reused in an insecure fashion by dhclient scripts This allows an attacker to execute arbitrary commands with the privileges of such a process b ...

127 ipTIME routers are vulnerable to a DHCP-related remote command execution vulnerability ...

15 TOTOLINK router models are vulnerable to multiple remote command execution vulnerabilities ...

CWE-20 http://secunia.com/advisories/44037 http://www.osvdb.org/71493 http://www.vupen.com/english/advisories/2011/0879 http://securitytracker.com/id?1025300 http://www.securityfocus.com/bid/47176 https://bugzilla.redhat.com/show_bug.cgi?id=689832 https://www.isc.org/software/dhcp/advisories/cve-2011-0997 http://www.kb.cert.org/vuls/id/107886 http://secunia.com/advisories/44048 http://secunia.com/advisories/44127 http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057888.html http://secunia.com/advisories/44089 http://www.redhat.com/support/errata/RHSA-2011-0428.html http://www.vupen.com/english/advisories/2011/0915 http://secunia.com/advisories/44103 http://www.debian.org/security/2011/dsa-2217 http://www.mandriva.com/security/advisories?name=MDVSA-2011:073 http://www.vupen.com/english/advisories/2011/0965 http://secunia.com/advisories/44090 http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058279.html http://secunia.com/advisories/44180 http://www.vupen.com/english/advisories/2011/0926 http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.593345 http://www.debian.org/security/2011/dsa-2216 http://www.vupen.com/english/advisories/2011/0886 http://www.vupen.com/english/advisories/2011/0909 http://www.ubuntu.com/usn/USN-1108-1 http://www.vupen.com/english/advisories/2011/1000 http://www.redhat.com/support/errata/RHSA-2011-0840.html http://marc.info/?l=bugtraq&m=133226187115472&w=2 http://security.gentoo.org/glsa/glsa-201301-06.xml http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 https://exchange.xforce.ibmcloud.com/vulnerabilities/66580 https://www.exploit-db.com/exploits/37623/https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12812 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=621099 https://nvd.nist.gov https://usn.ubuntu.com/1108-2/https://www.kb.cert.org/vuls/id/107886

CVE-2011-0997

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect