PT-2019-6649 · Isc · Dhcpv6

Tomas Hoger · Publicado 2019-11-27 · Atualizado 2019-12-18 · CVE-2011-2717

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions dhcpv6 project through 2011-07-25

Description The issue allows remote DHCP servers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message. This is a result of the DHCPv6 client (dhcp6c) not properly sanitizing hostnames received from DHCP messages, allowing an attacker to inject shell metacharacters and execute commands on the client system.

Recommendations For versions of the dhcpv6 project through 2011-07-25, consider disabling the dhcp6c client until a patch is available to prevent remote execution of arbitrary commands. Restrict access to the dhcp6c client to minimize the risk of exploitation. Avoid using hostnames that may contain shell metacharacters in DHCP messages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2011-2717

Produtos afetados

Dhcpv6

Referências · 6

• https://openwall.com/lists/oss-security/2011/07/26/9 · Nota
• https://t.me/cibsecurity/8382 · Publicação no Telegram
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2717 · Nota
• https://vigilance.fr/vulnerability/dhcp6c-shell-command-injection-10869 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-2717 · Nota de Segurança
• https://access.redhat.com/security/cve/cve-2011-2717 · Nota