DHCPCD Character Expansion Remote Command Execution Vulnerability

BID:6200

Info

DHCPCD Character Expansion Remote Command Execution Vulnerability

Bugtraq ID: 6200
Class: Input Validation Error
CVE: CVE-2002-1403
Remote: Yes
Local: No
Published: Nov 18 2002 12:00AM
Updated: Jul 11 2009 07:16PM
Credit: Vulnerability announced in a Conectiva security advisory.
Vulnerable: Phystech dhcpcd 1.3.22 -pl1
+ MandrakeSoft Multi Network Firewall 2.0
+ MandrakeSoft Single Network Firewall 7.2
+ Mandriva Linux Mandrake 9.0
+ Mandriva Linux Mandrake 8.2 ppc
 + Mandriva Linux Mandrake 8.2
+ Mandriva Linux Mandrake 8.1 ia64
 + Mandriva Linux Mandrake 8.1
+ Mandriva Linux Mandrake 8.0 ppc
 + Mandriva Linux Mandrake 8.0
+ Mandriva Linux Mandrake 7.2
Phystech dhcpcd 1.3.17 -pl2
+ Debian Linux 2.2 sparc
 + Debian Linux 2.2 powerpc
 + Debian Linux 2.2 IA-32
 + Debian Linux 2.2 arm
 + Debian Linux 2.2 alpha
 + Debian Linux 2.2 68k
 + Debian Linux 2.2
Not Vulnerable: Phystech dhcpcd 1.3.22 -pl3
Phystech dhcpcd 1.3.22 -pl2

Discussion

DHCPCD Character Expansion Remote Command Execution Vulnerability

When assigning an IP address to a network interface, dhcpcd may execute an external script, '/sbin/dhcpd-<interface>.exe'. This is an optional configuration that must be setup manually on Conectiva systems (others are not confirmed) by copying the script into /sbin/.

The script 'dhcpcd-<interface>.exe' uses values from '/var/lib/dhcpcd/dhcpcd-<interface>.info', which originate from the DHCP server. A lack of input validation on this data may make it possible for commands injected by a malicious DHCP server to be executed through the use of shell metacharacters such as ';' and '|'. These commands may run with root privileges.

Exploit / POC

DHCPCD Character Expansion Remote Command Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

DHCPCD Character Expansion Remote Command Execution Vulnerability

Solution:
Conectiva has released a security advisory. Fixes are available.

It is recommended that all Gentoo Linux users who are running
net-misc/dhcpcd-1.3.20_p0-r1 or earlier update their systems as
follows:

emerge rsync
emerge dhcpcd
emerge clean

The vendor has addressed the issue in the latest dhcpcd release.

Fixes:


Phystech dhcpcd 1.3.17 -pl2

Phystech dhcpcd 1.3.22 -pl1

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report