CVE-2011-0996

dhcpcd before 5.2.12 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message.

Score

CVSS 2.0 6.8 Medium

Status

Modified - cve@mitre.org

Published

2011-04-13

Last modified

2024-08-06

Weaknesses

CWE-20

Affected products

• Dhcpcd (Roy Marples)

References

• http://roy.marples.name/archives/dhcpcd-discuss/2011/0326.html
• http://roy.marples.name/projects/dhcpcd/changeset/c317b39786ac6c3a939dc711db7c78cf099859fd
• http://roy.marples.name/projects/dhcpcd/timeline
• http://secunia.com/advisories/44070
• http://security.gentoo.org/glsa/glsa-201301-04.xml
• http://www.securityfocus.com/bid/47272
• https://bugzilla.novell.com/show_bug.cgi?id=675052
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66641