PT-2019-6632 · Klibc · Klibc

Publicado 2019-11-14 · Atualizado 2020-08-18 · CVE-2011-1930

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions klibc versions 1.5.20 through 1.5.21

Description The issue arises from the improper escaping of DHCP options written by ipconfig to /tmp/net-$DEVICE.conf. This could potentially allow a remote attacker to send a specially crafted DHCP reply, which may execute arbitrary code with the privileges of any process that sources DHCP options.

Recommendations For klibc versions 1.5.20 and 1.5.21, consider restricting access to the DHCP options file until a proper fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2011-1930

Produtos afetados

Klibc

Referências · 9

• 🔥 https://exploit-db.com/exploits/35785 · Exploit
• http://security.gentoo.org/glsa/glsa-201309-21.xml · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-1930 · Aviso do Fabricante
• http://securityfocus.com/bid/47924 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1930 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/05/22/12 · Nota
• https://access.redhat.com/security/cve/cve-2011-1930 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1930 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2011-1930 · Aviso do Fabricante