Hi, I have found netif script to be susceptible to command injection from both command line and an arbitrary file name. It's probably happening in /etc/network.subr but I have not yet been able to patch it.
Example: service netif start ';id;' # Command injection from a file name touch '/tmp/;id;' service netif start '/tmp/*'
