Test Kennung:	1.3.6.1.4.1.25623.1.0.51556
Kategorie:	Conectiva Local Security Checks
Titel:	Conectiva Security Advisory CLA-2002:549
Zusammenfassung:	NOSUMMARY
Beschreibung:	Description: The remote host is missing updates announced in advisory CLA-2002:549. dhcpcd is an RFC2131 and RFC1541 compliant DHCP client daemon. dhcpcd has the ability to execute an external script named /sbin/dhcpcd-.exe when assigning a new IP address to a network interface. This script sources a file named /var/lib/dhcpcd/dhcpcd-.info that contains several shell variables and assigments with DHCP information. Simon Kelley pointed out a vulnerability in the way quotes inside these assignments are treated. By exploiting this, a malicious DHCP server (or attackers able to spoof DHCP responses) can execute arbitrary shell commands on the DHCP client (which is run by root). The script /sbin/dhcpcd-.exe is not installed by default in Conectiva Linux, but is included in the documentation directory of the dhcpcd package. Please notice that it is possible to exploit this vulnerability only if the user has installed the script manually. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://www.phystech.com/download/dhcpcd_changelog.html http://www.securityspace.com/smysecure/catid.html?in=CLA-2002:549 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002002 Risk factor : High
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.