Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Analysis of the DHCP Client Script Code Execution Vulnerability (CVE-2018-1111)

Summary: In May 2018, a command injection flaw was found in the NetworkManager integration script in the DHCP client packages of multiple Red Hat Enterprise Linux versions (CVE-2018-1111), which has since been patched. An attacker using a malicious DHCP server or spoofed DHCP responses on the local network could exploit the unchecked WPAD option to execute arbitrary commands with root privileges on systems running NetworkManager with DHCP configured.

What you should know: Proof-of-concept code for CVE-2018-1111 was released publicly on Twitter on May 16, 2018, and test code was posted to GitHub, so any unpatched RHEL 6 or 7 host on a network where an attacker can answer DHCP requests is exposed to root-level command execution.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Vulnerabilities & Patching
Mentions
CVE-2018-1111
Related