vulnwire
7.5high

CVE-2018-1111in critical feed2 exploits

DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
97.9%
percentile 100%
Public exploits
2
Exploit-DB

DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.

Exploit prediction (EPSS)

97.86% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-44890 DHCP Client - Command Injection 'DynoRoot' (Metasploit) · remote · 2018-06-13
  • EDB-44652 DynoRoot DHCP Client - Command Injection · local · 2018-05-18

CVSS scores

Assigned byVersionScoreVector
CNA3.07.5CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.07.5CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD3.07.5CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.9AV:A/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • Red Hat dhcp
  • Fedora dhcp

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

  • bugzilla.redhat.com /show_bug.cgi?id=CVE-2018-1111 · x_refsource_CONFIRM, x_transferred
  • tenable.com /security/tns-2018-10 · x_refsource_CONFIRM, x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/IDJA4QRR74TMXW34Q3DYYFPV · vendor-advisory, x_refsource_FEDORA, x_transferred
  • access.redhat.com /security/vulnerabilities/3442151 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/104195 · vdb-entry, x_refsource_BID, x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/QMTTB54QNTPD2SK6UL32EVQH · vendor-advisory, x_refsource_FEDORA, x_transferred
  • securitytracker.com /id/1040912 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • help.ecostruxureit.com /display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2018:1454 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1455 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1457 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1459 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1453 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/CDCLLCHYFFXW354HMB5QBXOQ · vendor-advisory, x_refsource_FEDORA, x_transferred
  • access.redhat.com /errata/RHSA-2018:1524 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1456 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1461 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • exploit-db.com /exploits/44652/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • exploit-db.com /exploits/44890/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • access.redhat.com /errata/RHSA-2018:1458 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:1460 · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.