Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE request - dhcp clients
From: Sebastian Krahmer <krahmer () suse de>
Date: Wed, 27 Jul 2011 10:57:39 +0200

Can you point us to the exact version and location in code where
the vulnerability is? I remember to have checked udhcpc at that
time and neither I found it setting a hostname or parsing
the options for a hostname.
The hostname it is using must be passed on the commandline
and are rather added to the request than parsed from a reply.

While we are on the hostname issue again, AFAIR the kernel contains
a DHCP client and was accepting hostname options so it could
theoretically be attacked the same way as with dhclient. However
this seems only a use-case for thin clients with NFS-root
or so and in such a case you can execute code on the client anyways.
So its not really worth fixing, except for vendors which lock
down their embedded devices before shipping it to their customers, but
who is doing that? :)


On Wed, Jul 27, 2011 at 09:28:48AM +0200, Tomas Hoger wrote:
On Tue, 26 Jul 2011 15:35:02 -0400 (EDT) Josh Bressers wrote:

Just to clarify...

Use CVE-2011-2716 for udhcpc

This is dhcp client that is part of busybox.

CVE-2011-2717 for udhcp6c.

This should say dhcp6c and is part of the (now obsolete) dhcpv6 project:


Tomas Hoger / Red Hat Security Response Team


~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer () suse de - SuSE Security Team

SUSE LINUX Products GmbH,
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Maxfeldstraße 5
90409 Nürnberg

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]