[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 18 May 2011 10:44:04 +0200
From: maximilian attems <max@...o.at>
To: oss-security@...ts.openwall.com
Cc: klibc@...or.com
Subject: [klibc] CVE request: klibc: ipconfig sh script with unescaped DHCP
options
Related to CVE-2011-0997
ipconfig vulnerability for malicious dhcpd if $DNSDOMAIN is later
used unquoted, than proof of concept involves
DNSDOMAIN="\\\"\$(echo owned; touch /tmp/owned)"
fix:
http://git.kernel.org/?p=libs/klibc/klibc.git;a=commit;h=46a0f831582629612f0ff9707ad1292887f26bff
will be part of the just to be released klibc-1.5.22
--
maks
_______________________________________________
klibc mailing list
klibc@...or.com
http://www.zytor.com/mailman/listinfo/klibc
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Powered by Openwall GNU/*/Linux -
Powered by OpenVZ
