Command injection in DHCP - CVE-2018-1111

Vulnerability identifier: #VU12743

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-1111

CWE-ID: CWE-77

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a physical attacker to execute arbitrary commands with elevated privileges on the target system.

The weakness exists in the NetworkManager integration script due to command injection. A physical attacker can return specially crafted data via dhcp and execute arbitrary commands with root privileges.

DHCP
Amazon Linux AMI
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for ARM
Red Hat Enterprise Linux EUS Compute Node
Fedora
Red Hat Virtualization
Red Hat Virtualization Host
dhcp

Install update from vendor's website.

dhcp - addressed in versions 4.3.5-11.fc26, 4.3.6-10.fc27, 4.3.6-20.fc28

• Exploit #6369 - DynoRoot DHCP Client - Command Injection (June 17, 2021)
• Exploit #6298 - DHCP Client - Command Injection 'DynoRoot' (Metasploit) (June 17, 2021)
• Exploit #4864 - FEP3370-advanced-ethical-hacking (DHCP exploitation with DynoRoot (CVE-2018-1111)) (November 21, 2020)
• Exploit #1743 - DHCP Client Command Injection (DynoRoot) (March 18, 2020)

• https://access.redhat.com/security/vulnerabilities/3442151

• Command execution in ISC Dhcp
• Red Hat update for ISC DHCP
• Red Hat update for ISC DHCP
• Red Hat update for ISC DHCP
• Red Hat update for ISC DHCP
• Red Hat update for ISC DHCP
• Red Hat update for ISC DHCP
• Red Hat update for ISC DHCP
• Red Hat update for ISC DHCP
• Red Hat update for ISC DHCP
• Red Hat update for ISC DHCP
• Amazon Linux AMI update for dhcp
• Fedora 28 update for dhcp
• Fedora 27 update for dhcp
• Fedora 26 update for dhcp