ID de Prueba:	1.3.6.1.4.1.25623.1.0.51556
Categoría:	Conectiva Local Security Checks
Título:	Conectiva Security Advisory CLA-2002:549
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory CLA-2002:549. dhcpcd is an RFC2131 and RFC1541 compliant DHCP client daemon. dhcpcd has the ability to execute an external script named /sbin/dhcpcd-.exe when assigning a new IP address to a network interface. This script sources a file named /var/lib/dhcpcd/dhcpcd-.info that contains several shell variables and assigments with DHCP information. Simon Kelley pointed out a vulnerability in the way quotes inside these assignments are treated. By exploiting this, a malicious DHCP server (or attackers able to spoof DHCP responses) can execute arbitrary shell commands on the DHCP client (which is run by root). The script /sbin/dhcpcd-.exe is not installed by default in Conectiva Linux, but is included in the documentation directory of the dhcpcd package. Please notice that it is possible to exploit this vulnerability only if the user has installed the script manually. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://www.phystech.com/download/dhcpcd_changelog.html http://www.securityspace.com/smysecure/catid.html?in=CLA-2002:549 http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002002 Risk factor : High
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.