CVE-2018-1111 dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script

SUMMARY

Update dhclient package

CVE ID

CVE-2018-1111

DESCRIPTION

A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.

Severity        Critical
CVSS3 Base Score    7.5
Public date:  2018-05-15
 

RESOLUTION

Apply Unitrends security update v10.28 from 05/21/2018 or later, containing dhclient-4.1.1-53.P1.el6.centos.4
This will correspond to unitrends-security-10.2.0-3.201805211531.

LINK TO ADVISORIES

• https://access.redhat.com/security/cve/cve-2018-1111 https://access.redhat.com/security/vulnerabilities/3442151 https://access.redhat.com/errata/RHSA-2018:1454 https://www.linux.org/threads/centos-announce-cesa-2018-1454-critical-centos-6-dhcp-security-update.17781/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1111