[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110727112613.7645881f@redhat.com>
Date: Wed, 27 Jul 2011 11:26:13 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request - dhcp clients
On Wed, 27 Jul 2011 10:57:39 +0200 Sebastian Krahmer wrote:
> Can you point us to the exact version and location in code where
> the vulnerability is?
I've not previously looked at the code more closely to find the exact
spot to be fixed. However, I have successfully reproduced the issue
with busybox 1.15.1 at least, not sure if I looked at any older
version too. It should be trivial to reproduce by running udhcpc -s
<script>, where script just dumps whole env. You should see
server-provided options exported (hostname, domain).
> I remember to have checked udhcpc at that time and neither I found it
> setting a hostname or parsing the options for a hostname.
Looks like fill_envp is the place:
http://git.busybox.net/busybox/tree/networking/udhcp/dhcpc.c#n341
The logic was little different in older versions:
http://git.busybox.net/busybox/tree/networking/udhcp/dhcpc.c?id=9ac5596a#n336
When I talked to upstream, they did see the issue and opened the bug:
https://bugs.busybox.net/show_bug.cgi?id=3979
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
