drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ungewollte Kommandoausführung in dhcpcd
Name: |
Ungewollte Kommandoausführung in dhcpcd
|
|
ID: |
200301-3 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
So, 5. Januar 2003, 12:00 |
|
Referenzen: |
Keine Angabe |
|
Applikationen: |
dhcpcd |
|
Originalnachricht |
-------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200301-3 --------------------------------------------------------------------
PACKAGE : dhcpcd SUMMARY : remote command execution DATE : 2003-01-05 00:01 UTC EXPLOIT : remote
--------------------------------------------------------------------
When assigning an IP address to a network interface, dhcpcd may execute an external script, '/sbin/dhcpd-<interface>.exe'. This is an optional configuration that must be setup manually on Gentoo Linux systems by copying the script into /sbin/. The script 'dhcpcd-<interface>.exe' uses values from '/var/lib/dhcpcd/dhcpcd-<interface>.info', which originate from the DHCP server. A lack of input validation on this data may make it possible for commands injected by a malicious DHCP server to be executed through the use of shell metacharacters such as ';' and '|'. These commands may run with root privileges.
More information is available at http://online.securityfocus.com/bid/6200/info/
SOLUTION
It is recommended that all Gentoo Linux users who are running net-misc/dhcpcd-1.3.20_p0-r1 or earlier update their systems as follows:
emerge rsync emerge dhcpcd emerge clean
-------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at www.gentoo.org/~aliz --------------------------------------------------------------------
-- gentoo-security@gentoo.org mailing list
|
|
|
|