DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Fedora | Fedoraproject | 26 (including) | 26 (including) |
Fedora | Fedoraproject | 27 (including) | 27 (including) |
Fedora | Fedoraproject | 28 (including) | 28 (including) |
Red Hat Enterprise Linux 6 | RedHat | dhcp-12:4.1.1-53.P1.el6_9.4 | * |
Red Hat Enterprise Linux 6.4 Advanced Update Support | RedHat | dhcp-12:4.1.1-34.P1.el6_4.2 | * |
Red Hat Enterprise Linux 6.5 Advanced Update Support | RedHat | dhcp-12:4.1.1-38.P1.el6_5.1 | * |
Red Hat Enterprise Linux 6.6 Advanced Update Support | RedHat | dhcp-12:4.1.1-43.P1.el6_6.2 | * |
Red Hat Enterprise Linux 6.6 Telco Extended Update Support | RedHat | dhcp-12:4.1.1-43.P1.el6_6.2 | * |
Red Hat Enterprise Linux 6.7 Extended Update Support | RedHat | dhcp-12:4.1.1-49.P1.el6_7.1 | * |
Red Hat Enterprise Linux 7 | RedHat | dhcp-12:4.2.5-68.el7_5.1 | * |
Red Hat Enterprise Linux 7.2 Advanced Update Support | RedHat | dhcp-12:4.2.5-42.el7_2.1 | * |
Red Hat Enterprise Linux 7.2 Telco Extended Update Support | RedHat | dhcp-12:4.2.5-42.el7_2.1 | * |
Red Hat Enterprise Linux 7.2 Update Services for SAP Solutions | RedHat | dhcp-12:4.2.5-42.el7_2.1 | * |
Red Hat Enterprise Linux 7.3 Extended Update Support | RedHat | dhcp-12:4.2.5-47.el7_3.1 | * |
Red Hat Enterprise Linux 7.4 Extended Update Support | RedHat | dhcp-12:4.2.5-58.el7_4.4 | * |
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | RedHat | imgbased-0:1.0.16-0.1.el7ev | * |
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | RedHat | ovirt-node-ng-0:4.2.0-0.20170814.0.el7 | * |
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | RedHat | redhat-release-virtualization-host-0:4.2-3.0.el7 | * |
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | RedHat | redhat-virtualization-host-0:4.2-20180508.0 | * |
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | RedHat | rhvm-appliance-0:4.2-20180504.0 | * |
Command injection vulnerabilities typically occur when:
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks. Command injection is a common problem with wrapper programs.