Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Jul 2011 10:57:39 +0200
From: Sebastian Krahmer <>
Subject: Re: CVE request - dhcp clients

Can you point us to the exact version and location in code where
the vulnerability is? I remember to have checked udhcpc at that
time and neither I found it setting a hostname or parsing
the options for a hostname.
The hostname it is using must be passed on the commandline
and are rather added to the request than parsed from a reply.

While we are on the hostname issue again, AFAIR the kernel contains
a DHCP client and was accepting hostname options so it could
theoretically be attacked the same way as with dhclient. However
this seems only a use-case for thin clients with NFS-root
or so and in such a case you can execute code on the client anyways.
So its not really worth fixing, except for vendors which lock
down their embedded devices before shipping it to their customers, but
who is doing that? :)


On Wed, Jul 27, 2011 at 09:28:48AM +0200, Tomas Hoger wrote:
> On Tue, 26 Jul 2011 15:35:02 -0400 (EDT) Josh Bressers wrote:
> Just to clarify...
> > Use CVE-2011-2716 for udhcpc
> This is dhcp client that is part of busybox.
> > CVE-2011-2717 for udhcp6c.
> This should say dhcp6c and is part of the (now obsolete) dhcpv6 project:
> -- 
> Tomas Hoger / Red Hat Security Response Team


~ perl
~ $_='print"\$_=\47$_\47;eval"';eval
~ - SuSE Security Team

SUSE LINUX Products GmbH,
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Maxfeldstraße 5
90409 Nürnberg

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.