Description
dhcpcd before 5.2.12 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message.
References
- http://roy.marples.name/projects/dhcpcd/timeline
- https://bugzilla.novell.com/show_bug.cgi?id=675052
- dhcpcd-response-command-execution(66641) vdb-entry
- [dhcpcd-discuss] 20110406 [CVE-2011-996] dhcpcd does not strip or escape shell meta characters mailing-list
- 44070 third-party-advisory
- http://roy.marples.name/projects/dhcpcd/changeset/c317b39786ac6c3a939dc711db7c78cf099859fd
- 47272 vdb-entry
- GLSA-201301-04 vendor-advisory