Hey guys, It was recently discovered (NOT by myself) that the ISC dhclient was vulnerable to certain shell metacharacters in the hostname parameter specified by *any* DHCP server, causing it to potentially run arbitrary commands as root. I haven't seen anything else on it here, so I figured I'd make everyone aware.
There's only one real phrase that comes to mind => WTF? https://www.isc.org/software/dhcp/advisories/cve-2011-0997 http://www.h-online.com/security/news/item/DHCP-client-allows-shell-command-injection-1222805.html Ryan _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
