ID CVE-2018-1111
Summary DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.
References
Vulnerable Configurations
  • Fedora 26
    cpe:2.3:o:fedoraproject:fedora:26
  • Fedora 27
    cpe:2.3:o:fedoraproject:fedora:27
  • Fedora 28
    cpe:2.3:o:fedoraproject:fedora:28
  • cpe:2.3:a:redhat:enterprise_virtualization:4.0
    cpe:2.3:a:redhat:enterprise_virtualization:4.0
  • cpe:2.3:a:redhat:enterprise_virtualization:4.2
    cpe:2.3:a:redhat:enterprise_virtualization:4.2
  • cpe:2.3:a:redhat:enterprise_virtualization_host:4.0
    cpe:2.3:a:redhat:enterprise_virtualization_host:4.0
  • cpe:2.3:o:redhat:enterprise_linux:6.0
    cpe:2.3:o:redhat:enterprise_linux:6.0
  • cpe:2.3:o:redhat:enterprise_linux:6.4
    cpe:2.3:o:redhat:enterprise_linux:6.4
  • cpe:2.3:o:redhat:enterprise_linux:6.5
    cpe:2.3:o:redhat:enterprise_linux:6.5
  • cpe:2.3:o:redhat:enterprise_linux:6.6
    cpe:2.3:o:redhat:enterprise_linux:6.6
  • Red Hat Enterprise Linux 6.7
    cpe:2.3:o:redhat:enterprise_linux:6.7
  • Red Hat Enterprise Linux (RHEL) 7.0 (7)
    cpe:2.3:o:redhat:enterprise_linux:7.0
  • Red Hat Enterprise Linux 7.2
    cpe:2.3:o:redhat:enterprise_linux:7.2
  • Red Hat Enterprise Linux 7.3
    cpe:2.3:o:redhat:enterprise_linux:7.3
  • Red Hat Enterprise Linux 7.4
    cpe:2.3:o:redhat:enterprise_linux:7.4
  • Red Hat Enterprise Linux 7.5
    cpe:2.3:o:redhat:enterprise_linux:7.5
  • Red Hat Enterprise Linux Desktop 6.0
    cpe:2.3:o:redhat:enterprise_linux_desktop:6.0
  • RedHat Enterprise Linux Desktop 7.0
    cpe:2.3:o:redhat:enterprise_linux_desktop:7.0
  • Red Hat Enterprise Linux Server 6.0
    cpe:2.3:o:redhat:enterprise_linux_server:6.0
  • RedHat Enterprise Linux Server 7.0
    cpe:2.3:o:redhat:enterprise_linux_server:7.0
  • Red Hat Enterprise Linux Workstation 6.0
    cpe:2.3:o:redhat:enterprise_linux_workstation:6.0
  • RedHat Enterprise Linux Workstation 7.0
    cpe:2.3:o:redhat:enterprise_linux_workstation:7.0
CVSS
Base: 7.9
Impact:
Exploitability:
CWE CWE-77
CAPEC
  • Cause Web Server Misclassification
    An attack of this type exploits a Web server's decision to take action based on filename or file extension. Because different file types are handled by different server processes, misclassification may force the Web server to take unexpected action, or expected actions in an unexpected sequence. This may cause the server to exhaust resources, supply debug or system data to the attacker, or bind an attacker to a remote process. This type of vulnerability has been found in many widely used servers including IIS, Lotus Domino, and Orion. The attacker's job in this case is straightforward, standard communication protocols and methods are used and are generally appended with malicious information at the tail end of an otherwise legitimate request. The attack payload varies, but it could be special characters like a period or simply appending a tag that has a special meaning for operations on the server side like .jsp for a java application server. The essence of this attack is that the attacker deceives the server into executing functionality based on the name of the request, i.e. login.jsp, not the contents.
  • LDAP Injection
    An attacker manipulates or crafts an LDAP query for the purpose of undermining the security of the target. Some applications use user input to create LDAP queries that are processed by an LDAP server. For example, a user might provide their username during authentication and the username might be inserted in an LDAP query during the authentication process. An attacker could use this input to inject additional commands into an LDAP query that could disclose sensitive information. For example, entering a * in the aforementioned query might return information about all users on the system. This attack is very similar to an SQL injection attack in that it manipulates a query to gather additional information or coerce a particular return value.
  • Command Delimiters
    An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or a blacklist input validation, as opposed to whitelist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or blacklist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
  • File System Function Injection, Content Based
    An attack of this type exploits the host's trust in executing remote content including binary files. The files are poisoned with a malicious payload (targeting the file systems accessible by the target software) by the attacker and may be passed through standard channels such as via email, and standard web content like PDF and multimedia files. The attacker exploits known vulnerabilities or handling routines in the target processes. Vulnerabilities of this type have been found in a wide variety of commercial applications from Microsoft Office to Adobe Acrobat and Apple Safari web browser. When the attacker knows the standard handling routines and can identify vulnerabilities and entry points they can be exploited by otherwise seemingly normal content. Once the attack is executed, the attackers' program can access relative directories such as C:\Program Files or other standard system directories to launch further attacks. In a worst case scenario, these programs are combined with other propagation logic and work as a virus.
  • Exploiting Multiple Input Interpretation Layers
    An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a "layer" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop.
  • Argument Injection
    An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.
  • Manipulating Writeable Configuration Files
    Generally these are manually edited files that are not in the preview of the system administrators, any ability on the attackers' behalf to modify these files, for example in a CVS repository, gives unauthorized access directly to the application, the same as authorized users.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
exploit-db via4
  • description DynoRoot DHCP Client - Command Injection. CVE-2018-1111. Local exploit for Linux platform
    file exploits/linux/local/44652.py
    id EDB-ID:44652
    last seen 2018-05-24
    modified 2018-05-18
    platform linux
    port
    published 2018-05-18
    reporter Exploit-DB
    source https://www.exploit-db.com/download/44652/
    title DynoRoot DHCP Client - Command Injection
    type local
  • description DHCP Client - Command Injection (DynoRoot) (Metasploit). CVE-2018-1111. Remote exploit for Linux platform. Tags: Metasploit Framework (MSF), Remote
    file exploits/linux/remote/44890.rb
    id EDB-ID:44890
    last seen 2018-06-13
    modified 2018-06-13
    platform linux
    port
    published 2018-06-13
    reporter Exploit-DB
    source https://www.exploit-db.com/download/44890/
    title DHCP Client - Command Injection (DynoRoot) (Metasploit)
    type remote
metasploit via4
description This module exploits the DynoRoot vulnerability, a flaw in how the NetworkManager integration script included in the DHCP client in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier processes DHCP options. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.
id MSF:EXPLOIT/UNIX/DHCP/RHEL_DHCP_CLIENT_COMMAND_INJECTION
last seen 2019-03-21
modified 2018-08-27
published 2018-05-18
reliability Excellent
reporter Rapid7
source https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/dhcp/rhel_dhcp_client_command_injection.rb
title DHCP Client Command Injection (DynoRoot)
nessus via4
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2018-0042.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - Added oracle-errwarn-message.patch - Resolves: #1570897 - Fix comamnd execution in NM script (CVE-2018-1111) - Resolves: #1550085 - CVE-2018-5733 Avoid reference overflow <[12:4.1.1-53.P1.2 - Resolves: #1550083 - CVE-2018-5732 Avoid options buffer overflow - Resolves: #1063217 - failover hangs with both potential-conflict
    last seen 2019-02-21
    modified 2018-09-05
    plugin id 109830
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109830
    title OracleVM 3.3 / 3.4 : dhcp (OVMSA-2018-0042)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2018-1123.NASL
    description According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.(CVE-2018-1111) - ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.(CVE-2015-8605) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-13
    plugin id 110127
    published 2018-05-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110127
    title EulerOS 2.0 SP2 : dhcp (EulerOS-SA-2018-1123)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2018-1122.NASL
    description According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.(CVE-2018-1111) - ISC DHCP 4.x before 4.1-ESV-R12-P1, 4.2.x, and 4.3.x before 4.3.3-P1 allows remote attackers to cause a denial of service (application crash) via an invalid length field in a UDP IPv4 packet.(CVE-2015-8605) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-13
    plugin id 110126
    published 2018-05-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110126
    title EulerOS 2.0 SP1 : dhcp (EulerOS-SA-2018-1122)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1524.NASL
    description Updated redhat-virtualization-host packages that fix several bugs and add various enhancements are now available. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. Includes GlusterFS fixes for CVE-2018-1088, dhcp fixes for CVE-2018-1111, kernel fixes for CVE-2018-1087, and kernel fixes for CVE-2018-8897. A list of bugs fixed in this update is available in the Technical Notes book: https://access.redhat.com/documentation/en-us/red_hat_virtualization/4 .2/html/ technical_notes/
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109909
    published 2018-05-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109909
    title RHEL 7 : Virtualization (RHSA-2018:1524)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1525.NASL
    description An update for rhvm-appliance is now available for Red Hat Virtualization 4 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is available to download as an OVA file from the Customer Portal. The following packages have been upgraded to a later upstream version: rhvm-appliance (4.2). (BZ#1558801, BZ#1563545) Security Fix(es) : * python-paramiko: Authentication bypass in transport.py (CVE-2018-7750) * slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088) * undertow: Client can use bogus uri in Digest authentication (CVE-2017-12196) * jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485) (CVE-2018-5968) * ovirt-engine: account enumeration through login to web console (CVE-2018-1073) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Chris McCown for reporting CVE-2018-8088. The CVE-2017-12196 issue was discovered by Jan Stourac (Red Hat). Enhancement(s) : * Previously, the default memory allotment for the RHV-M Virtual Appliance was always large enough to include support for user additions. In this release, the RHV-M Virtual Appliance includes a swap partition that enables the memory to be increased when required. (BZ#1422982) * Previously, the partitioning scheme for the RHV-M Virtual Appliance included two primary partitions, '/' and swap. In this release, the disk partitioning scheme has been modified to match the scheme specified by NIST. The updated disk partitions are as follows : /boot 1G (primary) /home 1G (lvm) /tmp 2G (lvm) /var 20G (lvm) /var/log 10G (lvm) /var/log/audit 1G (lvm) swap 8G (lvm) / 6G (primary) (BZ#1463853) * Previously, the version tag was used as part of the RPM's naming scheme, for example, '4.1.timestamp', which created differences between the upstream and downstream versioning schemes. In this release, the downstream versioning scheme is aligned with the upstream scheme and the timestamp has moved from the version tag to the release tag. (BZ#1464486)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109910
    published 2018-05-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109910
    title RHEL 7 : Virtualization (RHSA-2018:1525)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2018-1454.NASL
    description From Red Hat Security Advisory 2018:1454 : An update for dhcp is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es) : * A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111) Red Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.
    last seen 2019-02-21
    modified 2018-09-05
    plugin id 109827
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109827
    title Oracle Linux 6 : dhcp (ELSA-2018-1454)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1458.NASL
    description An update for dhcp is now available for Red Hat Enterprise Linux 6.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es) : * A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111) Red Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109844
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109844
    title RHEL 6 : dhcp (RHSA-2018:1458)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-5392896132.NASL
    description fix for CVE-2018-1111 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-05
    plugin id 109874
    published 2018-05-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109874
    title Fedora 26 : 12:dhcp (2018-5392896132)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1455.NASL
    description An update for dhcp is now available for Red Hat Enterprise Linux 7.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es) : * A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111) Red Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109841
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109841
    title RHEL 7 : dhcp (RHSA-2018:1455)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1460.NASL
    description An update for dhcp is now available for Red Hat Enterprise Linux 6.5 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es) : * A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111) Red Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109846
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109846
    title RHEL 6 : dhcp (RHSA-2018:1460)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2018-1454.NASL
    description An update for dhcp is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es) : * A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111) Red Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109815
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109815
    title CentOS 6 : dhcp (CESA-2018:1454)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20180515_DHCP_ON_SL6_X.NASL
    description Security Fix(es) : - A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Scientific Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111)
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 109849
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109849
    title Scientific Linux Security Update : dhcp on SL6.x i386/x86_64
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-36058ED9F2.NASL
    description fix for CVE-2018-1111 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-05
    plugin id 109820
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109820
    title Fedora 27 : 12:dhcp (2018-36058ed9f2)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1459.NASL
    description An update for dhcp is now available for Red Hat Enterprise Linux 6.6 Advanced Update Support and Red Hat Enterprise Linux 6.6 Telco Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es) : * A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111) Red Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109845
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109845
    title RHEL 6 : dhcp (RHSA-2018:1459)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2018-1453.NASL
    description From Red Hat Security Advisory 2018:1453 : An update for dhcp is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es) : * A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111) Red Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.
    last seen 2019-02-21
    modified 2018-09-05
    plugin id 109826
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109826
    title Oracle Linux 7 : dhcp (ELSA-2018-1453)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-23CA7A6798.NASL
    description fix for CVE-2018-1111 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-03
    plugin id 120293
    published 2019-01-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=120293
    title Fedora 28 : 12:dhcp (2018-23ca7a6798)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2018-1188.NASL
    description According to the version of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.(CVE-2018-1111) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-13
    plugin id 110852
    published 2018-07-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110852
    title EulerOS 2.0 SP3 : dhcp (EulerOS-SA-2018-1188)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1453.NASL
    description An update for dhcp is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es) : * A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111) Red Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109839
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109839
    title RHEL 7 : dhcp (RHSA-2018:1453)
  • NASL family Amazon Linux Local Security Checks
    NASL id AL2_ALAS-2018-1021.NASL
    description Command injection vulnerability in the DHCP client NetworkManager integration script : A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Amazon Linux 2. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111) Note: Amazon Linux 2 does not use NetworkManager by default, however it is recommended to install this update.
    last seen 2019-02-21
    modified 2018-08-31
    plugin id 110194
    published 2018-05-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110194
    title Amazon Linux 2 : dhcp (ALAS-2018-1021)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2018-1453.NASL
    description An update for dhcp is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es) : * A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111) Red Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109814
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109814
    title CentOS 7 : dhcp (CESA-2018:1453)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1454.NASL
    description An update for dhcp is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es) : * A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111) Red Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109840
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109840
    title RHEL 6 : dhcp (RHSA-2018:1454)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1456.NASL
    description An update for dhcp is now available for Red Hat Enterprise Linux 7.3 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es) : * A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111) Red Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109842
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109842
    title RHEL 7 : dhcp (RHSA-2018:1456)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1457.NASL
    description An update for dhcp is now available for Red Hat Enterprise Linux 7.2 Advanced Update Support, Red Hat Enterprise Linux 7.2 Telco Extended Update Support, and Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es) : * A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111) Red Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109843
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109843
    title RHEL 7 : dhcp (RHSA-2018:1457)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2018-1461.NASL
    description An update for dhcp is now available for Red Hat Enterprise Linux 6.4 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network. Security Fix(es) : * A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111) Red Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 109847
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109847
    title RHEL 6 : dhcp (RHSA-2018:1461)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20180515_DHCP_ON_SL7_X.NASL
    description Security Fix(es) : - A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Scientific Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111)
    last seen 2019-02-21
    modified 2018-12-27
    plugin id 109850
    published 2018-05-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109850
    title Scientific Linux Security Update : dhcp on SL7.x x86_64
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2018-1024.NASL
    description Command injection vulnerability in the DHCP client NetworkManager integration script A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Amazon Linux 2. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol. (CVE-2018-1111 ) Note: As mentioned above, the fix for this issue is in the NetworkManager integration script included with the dhcp package. The severity of this advisory has been lowered to a low as the Amazon Linux AMI does not use NetworkManager.
    last seen 2019-02-21
    modified 2018-08-31
    plugin id 110198
    published 2018-05-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110198
    title Amazon Linux AMI : dhcp (ALAS-2018-1024)
packetstorm via4
redhat via4
advisories
  • bugzilla
    id 1567974
    title CVE-2018-1111 dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 7 Client is installed
        oval oval:com.redhat.rhsa:tst:20140675001
      • comment Red Hat Enterprise Linux 7 Server is installed
        oval oval:com.redhat.rhsa:tst:20140675002
      • comment Red Hat Enterprise Linux 7 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20140675003
      • comment Red Hat Enterprise Linux 7 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20140675004
    • OR
      • AND
        • comment dhclient is earlier than 12:4.2.5-68.el7_5.1
          oval oval:com.redhat.rhsa:tst:20181453009
        • comment dhclient is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100923008
      • AND
        • comment dhcp is earlier than 12:4.2.5-68.el7_5.1
          oval oval:com.redhat.rhsa:tst:20181453011
        • comment dhcp is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100923006
      • AND
        • comment dhcp-common is earlier than 12:4.2.5-68.el7_5.1
          oval oval:com.redhat.rhsa:tst:20181453007
        • comment dhcp-common is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111819010
      • AND
        • comment dhcp-devel is earlier than 12:4.2.5-68.el7_5.1
          oval oval:com.redhat.rhsa:tst:20181453013
        • comment dhcp-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100923010
      • AND
        • comment dhcp-libs is earlier than 12:4.2.5-68.el7_5.1
          oval oval:com.redhat.rhsa:tst:20181453005
        • comment dhcp-libs is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20162590008
    rhsa
    id RHSA-2018:1453
    released 2018-05-15
    severity Critical
    title RHSA-2018:1453: dhcp security update (Critical)
  • bugzilla
    id 1567974
    title CVE-2018-1111 dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhsa:tst:20100842001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhsa:tst:20100842002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20100842003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20100842004
    • OR
      • AND
        • comment dhclient is earlier than 12:4.1.1-53.P1.el6_9.4
          oval oval:com.redhat.rhsa:tst:20181454007
        • comment dhclient is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100923008
      • AND
        • comment dhcp is earlier than 12:4.1.1-53.P1.el6_9.4
          oval oval:com.redhat.rhsa:tst:20181454005
        • comment dhcp is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100923006
      • AND
        • comment dhcp-common is earlier than 12:4.1.1-53.P1.el6_9.4
          oval oval:com.redhat.rhsa:tst:20181454011
        • comment dhcp-common is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111819010
      • AND
        • comment dhcp-devel is earlier than 12:4.1.1-53.P1.el6_9.4
          oval oval:com.redhat.rhsa:tst:20181454009
        • comment dhcp-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100923010
    rhsa
    id RHSA-2018:1454
    released 2018-05-15
    severity Critical
    title RHSA-2018:1454: dhcp security update (Critical)
  • rhsa
    id RHSA-2018:1455
  • rhsa
    id RHSA-2018:1456
  • rhsa
    id RHSA-2018:1457
  • rhsa
    id RHSA-2018:1458
  • rhsa
    id RHSA-2018:1459
  • rhsa
    id RHSA-2018:1460
  • rhsa
    id RHSA-2018:1461
  • rhsa
    id RHSA-2018:1524
rpms
  • dhclient-12:4.2.5-68.el7_5.1
  • dhcp-12:4.2.5-68.el7_5.1
  • dhcp-common-12:4.2.5-68.el7_5.1
  • dhcp-devel-12:4.2.5-68.el7_5.1
  • dhcp-libs-12:4.2.5-68.el7_5.1
  • dhclient-12:4.1.1-53.P1.el6_9.4
  • dhcp-12:4.1.1-53.P1.el6_9.4
  • dhcp-common-12:4.1.1-53.P1.el6_9.4
  • dhcp-devel-12:4.1.1-53.P1.el6_9.4
refmap via4
bid 104195
confirm
exploit-db
  • 44652
  • 44890
fedora
  • FEDORA-2018-23ca7a6798
  • FEDORA-2018-36058ed9f2
  • FEDORA-2018-5392896132
sectrack 1040912
saint via4
bid 104195
description Red Hat DHCP client NetworkManager integration script command injection
id misc_dhcpnetman
title redhat_dhcp_client_networkmanager
type client
the hacker news via4
id THN:5EF52673FFBE9DE255C1F2F387D2A84B
last seen 2018-05-15
modified 2018-05-15
published 2018-05-15
reporter Mohit Kumar
source https://thehackernews.com/2018/05/linux-dhcp-hacking.html
title Red Hat Linux DHCP Client Found Vulnerable to Command Injection Attacks
Last major update 17-05-2018 - 12:29
Published 17-05-2018 - 12:29
Last modified 22-04-2019 - 13:48
Back to Top