Re: CVE request - dhcp clients

[Sebastian Krahmer <krahmer () suse de>]

Can you point us to the exact version and location in code where
the vulnerability is? I remember to have checked udhcpc at that
time and neither I found it setting a hostname or parsing
the options for a hostname.
The hostname it is using must be passed on the commandline
and are rather added to the request than parsed from a reply.

While we are on the hostname issue again, AFAIR the kernel contains
a DHCP client and was accepting hostname options so it could
theoretically be attacked the same way as with dhclient. However
this seems only a use-case for thin clients with NFS-root
or so and in such a case you can execute code on the client anyways.
So its not really worth fixing, except for vendors which lock
down their embedded devices before shipping it to their customers, but
who is doing that? :)

Sebastian


On Wed, Jul 27, 2011 at 09:28:48AM +0200, Tomas Hoger wrote:
> On Tue, 26 Jul 2011 15:35:02 -0400 (EDT) Josh Bressers wrote:
>
> Just to clarify...
>
> > Use CVE-2011-2716 for udhcpc
>
> This is dhcp client that is part of busybox.
>
> > CVE-2011-2717 for udhcp6c.
>
> This should say dhcp6c and is part of the (now obsolete) dhcpv6 project:
>
>   https://fedorahosted.org/dhcpv6/
>
> -- 
> Tomas Hoger / Red Hat Security Response Team

-- 

~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer () suse de - SuSE Security Team

---
SUSE LINUX Products GmbH,
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Maxfeldstraße 5
90409 Nürnberg
Germany