NetSight
IP …
high7.5Public exploit code

CVE-2018-1111

DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script i…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.

Affected products

VendorProductAffected versions
FedoraprojectFedora
Versions 26, 27, 28
RedhatEnterprise Virtualization
Versions 4.0, 4.2
RedhatEnterprise Virtualization Host
Version 4.0
RedhatEnterprise Linux
Versions 6.0, 6.4, 6.5, 6.6, 6.7, 7.0
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0

Weakness classification

CWE-77CWE-78

References