Ask the Community
Groups
CVE-2018-1111 dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script - Connect IT Community | Kaseya
<main> <article class="userContent"> <h3 data-id="summary"><strong>SUMMARY</strong></h3> <p>Update dhclient package</p> <h3 data-id="cve-id"><strong>CVE ID</strong></h3> <p>CVE-2018-1111</p> <h3 data-id="description"><strong>DESCRIPTION</strong></h3> <p>A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.<br><br>Severity Critical<br>CVSS3 Base Score 7.5<br>Public date: 2018-05-15<br> </p> <h3 data-id="resolution"><strong>RESOLUTION</strong></h3> <p>Apply Unitrends security update v10.28 from 05/21/2018 or later, containing dhclient-4.1.1-53.P1.el6.centos.4<br>This will correspond to unitrends-security-10.2.0-3.201805211531.</p> <h3 data-id="link-to-advisories"><strong>LINK TO ADVISORIES</strong></h3> <p></p> <ul><li><a rel="nofollow" href="/home/leaving?allowTrusted=1&target=https%3A%2F%2Faccess.redhat.com%2Fsecurity%2Fcve%2Fcve-2018-1111%250D%250Ahttps%3A%2F%2Faccess.redhat.com%2Fsecurity%2Fvulnerabilities%2F3442151%250D%250Ahttps%3A%2F%2Faccess.redhat.com%2Ferrata%2FRHSA-2018%3A1454%250D%250Ahttps%3A%2F%2Fwww.linux.org%2Fthreads%2Fcentos-announce-cesa-2018-1454-critical-centos-6-dhcp-security-update.17781%2F%250D%250Ahttp%3A%2F%2Fweb.nvd.nist.gov%2Fview%2Fvuln%2Fdetail%3FvulnId%3DCVE-2018-1111">https://access.redhat.com/security/cve/cve-2018-1111 https://access.redhat.com/security/vulnerabilities/3442151 https://access.redhat.com/errata/RHSA-2018:1454 https://www.linux.org/threads/centos-announce-cesa-2018-1454-critical-centos-6-dhcp-security-update.17781/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1111</a></li></ul> </article> </main>