oss-sec mailing list archives
Re: CVE request - dhcp clients
From: Sebastian Krahmer <krahmer () suse de>
Date: Wed, 27 Jul 2011 10:57:39 +0200
Can you point us to the exact version and location in code where the vulnerability is? I remember to have checked udhcpc at that time and neither I found it setting a hostname or parsing the options for a hostname. The hostname it is using must be passed on the commandline and are rather added to the request than parsed from a reply. While we are on the hostname issue again, AFAIR the kernel contains a DHCP client and was accepting hostname options so it could theoretically be attacked the same way as with dhclient. However this seems only a use-case for thin clients with NFS-root or so and in such a case you can execute code on the client anyways. So its not really worth fixing, except for vendors which lock down their embedded devices before shipping it to their customers, but who is doing that? :) Sebastian On Wed, Jul 27, 2011 at 09:28:48AM +0200, Tomas Hoger wrote:
On Tue, 26 Jul 2011 15:35:02 -0400 (EDT) Josh Bressers wrote: Just to clarify...Use CVE-2011-2716 for udhcpcThis is dhcp client that is part of busybox.CVE-2011-2717 for udhcp6c.This should say dhcp6c and is part of the (now obsolete) dhcpv6 project: https://fedorahosted.org/dhcpv6/ -- Tomas Hoger / Red Hat Security Response Team
-- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer () suse de - SuSE Security Team --- SUSE LINUX Products GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg) Maxfeldstraße 5 90409 Nürnberg Germany
Current thread:
- CVE request - dhcp clients Tomas Hoger (Jul 25)
- Re: CVE request - dhcp clients Josh Bressers (Jul 26)
- Re: CVE request - dhcp clients Tomas Hoger (Jul 27)
- Re: CVE request - dhcp clients Sebastian Krahmer (Jul 27)
- Re: CVE request - dhcp clients Tomas Hoger (Jul 27)
- Re: CVE request - dhcp clients Sebastian Krahmer (Jul 27)
- Re: CVE request - dhcp clients Tomas Hoger (Jul 27)
- Re: CVE request - dhcp clients Josh Bressers (Jul 26)