klibc DHCP Options Processing Remote Shell Command Execution Vulnerability

Bugtraq ID:	47924
Class:	Input Validation Error
CVE:	CVE-2011-1930
Remote:	Yes
Local:	No
Published:	May 18 2011 12:00AM
Updated:	Sep 28 2013 12:14AM
Credit:	maximilian attems
Vulnerable:	Pardus Linux 2009 0 Linux klibc 1.5.21 Linux klibc 1.5.20 Gentoo Linux
Not Vulnerable:	Linux klibc 1.5.22

klibc DHCP Options Processing Remote Shell Command Execution Vulnerability

klibc is prone to a shell-command-execution vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary shell commands in the context of the application that uses the vulnerable library.

Versions prior to klibc 1.5.22 are vulnerable.

klibc DHCP Options Processing Remote Shell Command Execution Vulnerability

The following proof-of-concept is available:

DNSDOMAIN="\\\"\$(echo owned; touch /tmp/owned)"

klibc DHCP Options Processing Remote Shell Command Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.

klibc DHCP Options Processing Remote Shell Command Execution Vulnerability

References:

• [klibc] CVE request: klibc: ipconfig sh script with unescaped DHCP options (maximilian attems)
  
• [klibc] CVE request: klibc: ipconfig sh script with unescaped DHCP options (klibc)
  
• klibc Homepage (klibc)