CVE-2011-0997

Scores

EPSS

0.814high81.4%
0%20%40%60%80%100%

Percentile: 81.4%

CVSS

7.9high2.0
0246810

CVSS Score: 7.9/10

All CVSS Scores

CVSS 2.0
7.9

Vector: AV:A/AC:M/Au:N/C:C/I:C/A:C

Description

dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is provided to dhclient-script.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

debiannvdredhatubuntu

CWEs

CWE-20CWE-78

Related Vulnerabilities

Recommendations

Source: nvd

Apply an updateUsers who obtain ISC DHCP from a third-party vendor, such as their operating system vendor, should see the vendor information portion of this document for a partial list of affected vendors.This vulnerability is addressed in ISC DHCP version 3.1-ESV-R1, 4.1-ESV-R2 and 4.2.1-P1. Users of ISC DHCP from the original source distribution should upgrade to this version or later, as appropriate.See also https://www.isc.org/software/dhcp/advisories/cve-2011-0997According to ISC:On SUSE systems, it is possible to disable hostname update by setting DHCLIENT_SET_HOSTNAME=“no” in /etc/sysconfig/network/dhcp.Other systems may add following line to dhclient-script at the beginning of the set_hostname() function:new_host_name=${new_host_name//[^-.a-zA-Z0-9]/}In environments where filters/acls can be put into place to limit clients to accessing only legitimate dhcp servers, this will protect clientsfrom rogue dhcp servers deliberately trying to exploit this bug. However, this will not protect from compromised servers.

URL: http://www.kb.cert.org/vuls/id/107886

Vulnerable Software (11)

Type: Configuration

Product: dhcp

Operating System: rhel 3

Trait:
{  "fixed": "3.0.1-10.3_EL3"}

Source: redhat

Type: Configuration

Product: dhcp

Operating System: rhel 4

Trait:
{  "fixed": "3.0.1-67.el4"}

Source: redhat

Type: Configuration

Product: dhcp

Operating System: rhel 5

Trait:
{  "fixed": "3.0.5-23.el5_6.4"}

Source: redhat

Type: Configuration

Product: dhcp

Operating System: rhel 6

Trait:
{  "fixed": "4.1.1-12.P1.el6_0.4"}

Source: redhat

Type: Configuration

Product: dhcp3

Operating System: ubuntu hardy 8.04

Trait:
{  "fixed": "3.0.6.dfsg-1ubuntu9.2"}

Source: ubuntu

Type: Configuration

Product: dhcp3

Operating System: debian

Trait:
{  "unfixed": true}

Source: debian

Type: Configuration

Product: isc-dhcp

Operating System: debian

Trait:
{  "fixed": "4.1.1-P1-16.1"}

Source: debian

Type: Configuration

Vendor: canonical

Product: ubuntu_linux

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*...

Source: nvd

Type: Configuration

Vendor: debian

Product: debian_linux

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*",...

Source: nvd

Type: Configuration

Vendor: isc

Product: dhcp

Operating System: * * *

Trait:
{  "cpe_match": [    {      "cpe23uri": "cpe:2.3:a:isc:dhcp:3.0:*:*:*:*:*:*:*",      "vulnerable": true    },    {      "cpe23uri": "cpe:2.3:a:isc:dhcp:3.0.1:-:*:*:*:*:*:*",      "vulnerable":...

Source: nvd