CVE-2011-0997: Input Validation
dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is provided to dhclient-script.
Other sources
Sebastian Krahmer of the SUSE security team noticed that DHCP clients fail to sanitize certain values supplied by DHCP servers during the DHCP communication. The example of such value is hostname configured on the DHCP client. Various scripts assume hostname is trusted and do not sufficiently escape or quote it. Malicious DHCP server can use this to execute arbitrary code on the DHCP client by supplying a specially-crafted hostname.
Acknowledgement:
Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0997?
CVE-2011-0997 has a severity rating of high due to its potential to allow remote code execution.
How do I fix CVE-2011-0997?
To fix CVE-2011-0997, upgrade to ISC DHCP version 4.2.1-P1 or later, or to versions 3.1-ESV-R1 and 4.1-ESV-R2.
Which versions of ISC DHCP are affected by CVE-2011-0997?
CVE-2011-0997 affects ISC DHCP versions 3.0.x through 4.2.x before 4.2.1-P1, as well as 3.1-ESV before 3.1-ESV-R1.
What are the potential risks associated with CVE-2011-0997?
The risk associated with CVE-2011-0997 includes the possibility of remote attackers executing arbitrary commands on the affected system.
Is there a workaround for CVE-2011-0997?
While upgrading is the best option, disabling DHCP or filtering DHCP requests can serve as a temporary workaround for CVE-2011-0997.