[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Jul 2011 10:57:39 +0200
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request - dhcp clients
Can you point us to the exact version and location in code where
the vulnerability is? I remember to have checked udhcpc at that
time and neither I found it setting a hostname or parsing
the options for a hostname.
The hostname it is using must be passed on the commandline
and are rather added to the request than parsed from a reply.
While we are on the hostname issue again, AFAIR the kernel contains
a DHCP client and was accepting hostname options so it could
theoretically be attacked the same way as with dhclient. However
this seems only a use-case for thin clients with NFS-root
or so and in such a case you can execute code on the client anyways.
So its not really worth fixing, except for vendors which lock
down their embedded devices before shipping it to their customers, but
who is doing that? :)
Sebastian
On Wed, Jul 27, 2011 at 09:28:48AM +0200, Tomas Hoger wrote:
> On Tue, 26 Jul 2011 15:35:02 -0400 (EDT) Josh Bressers wrote:
>
> Just to clarify...
>
> > Use CVE-2011-2716 for udhcpc
>
> This is dhcp client that is part of busybox.
>
> > CVE-2011-2717 for udhcp6c.
>
> This should say dhcp6c and is part of the (now obsolete) dhcpv6 project:
>
> https://fedorahosted.org/dhcpv6/
>
> --
> Tomas Hoger / Red Hat Security Response Team
--
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
---
SUSE LINUX Products GmbH,
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Maxfeldstraße 5
90409 Nürnberg
Germany
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
