Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 27 Jul 2011 11:43:20 +0200
From: Sebastian Krahmer <>
Subject: Re: CVE request - dhcp clients

Ah ok, so the delivered scripts actually do this. Thanks
for the pointer.


On Wed, Jul 27, 2011 at 11:26:13AM +0200, Tomas Hoger wrote:
> On Wed, 27 Jul 2011 10:57:39 +0200 Sebastian Krahmer wrote:
> > Can you point us to the exact version and location in code where
> > the vulnerability is?
> I've not previously looked at the code more closely to find the exact
> spot to be fixed.  However, I have successfully reproduced the issue
> with busybox 1.15.1 at least, not sure if I looked at any older
> version too.  It should be trivial to reproduce by running udhcpc -s
> <script>, where script just dumps whole env.  You should see
> server-provided options exported (hostname, domain).
> > I remember to have checked udhcpc at that time and neither I found it
> > setting a hostname or parsing the options for a hostname.
> Looks like fill_envp is the place:
> The logic was little different in older versions:
> When I talked to upstream, they did see the issue and opened the bug:
> -- 
> Tomas Hoger / Red Hat Security Response Team


~ perl
~ $_='print"\$_=\47$_\47;eval"';eval
~ - SuSE Security Team

SUSE LINUX Products GmbH,
GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 16746 (AG Nürnberg)
Maxfeldstraße 5
90409 Nürnberg

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.