pjp
Administrator
Joined: 16 Apr 2002
Posts: 20506
|
 Posted: Mon Jan 06, 2003 12:58 am Post subject: [gentoo-security] GLSA: dhcpcd |
 |
|
| Daniel Ahlberg wrote: | - - --------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200301-3
- - --------------------------------------------------------------------
PACKAGE : dhcpcd
SUMMARY�: remote command execution
DATE �� : 2003-01-05 00:01 UTC
EXPLOIT : remote
- - --------------------------------------------------------------------
When assigning an IP address to a network interface, dhcpcd may
execute an external script, '/sbin/dhcpd-<interface>.exe'.
This is an optional configuration that must be setup manually on
Gentoo Linux systems by copying the script
into /sbin/.
The script 'dhcpcd-<interface>.exe' uses values from
'/var/lib/dhcpcd/dhcpcd-<interface>.info', which originate from the
DHCP server. A lack of input validation on this data may make it
possible for commands injected by a malicious DHCP server to be
executed through the use of shell metacharacters such as ';' and '|'.
These commands may run with root privileges.
More information is available at
http://online.securityfocus.com/bid/6200/info/
SOLUTION
It is recommended that all Gentoo Linux users who are running
net-misc/dhcpcd-1.3.20_p0-r1 or earlier update their systems as
follows:
emerge rsync
emerge dhcpcd
emerge clean
- - --------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at www.gentoo.org/~aliz
- - -------------------------------------------------------------------- |
Mailing List Archive: Unavailable
_________________
Quis separabit? Quo animo? |
|
News & Announcements
