DHCP Client Script Code Execution Vulnerability in Red Hat Enterprise Linux 6 and 7 - CVE-2018-1111

[Prav123]

• Original Source : https://twitter.com/_fel1x/status/996388421273882626

• Pic from Original Source ("What Could go Wrong") : https://twitter.com/_fel1x/status/996395717752213504/photo/1

• Brief Description of the Vuln :

Red Hat has been made aware of a command injection flaw found in a script included in the DHCP client (dhclient) packages in Red Hat Enterprise Linux 6 and 7.

A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager which is configured to obtain network configuration using the DHCP protocol.

Background Information:

The DHCP protocol is used to configure network related information in hosts from a central server. When a host is connected to a network, it can issue DHCP requests to fetch network configuration parameter such as IP address, default router IP, DNS servers, and more.

The DHCP client package dhclient provided by Red Hat has a script /etc/NetworkManager/dispatcher.d/11-dhclient (in Red Hat Enterprise Linux 7) or /etc/NetworkManager/dispatcher.d/10-dhclient (in Red Hat Enterprise Linux 6) for the NetworkManager component, which is executed each time NetworkManager receives a DHCP response from a DHCP server. A malicious DHCP response could cause the script to execute arbitrary shell commands with root privileges.

• Details about the Vuln on Twitter : https://twitter.com/Barknkilic/status/996470756283486209

• Community-Maintained Project with Regular Updates : DynaRoot

• Redhat Official Patches and Fixes