Vulnerability Details : CVE-2018-1111
Public exploit exists!
DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.
Products affected by CVE-2018-1111
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:6.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:6.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:6.6:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:enterprise_virtualization:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:enterprise_virtualization:4.2:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:enterprise_virtualization_host:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:26:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:27:*:*:*:*:*:*:*
Threat overview for CVE-2018-1111
Top countries where our scanners detected CVE-2018-1111
Top open port discovered on systems with this issue
53
IPs affected by CVE-2018-1111 754,055
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2018-1111!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2018-1111
91.46%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2018-1111
-
DHCP Client Command Injection (DynoRoot)
Disclosure Date: 2018-05-15First seen: 2020-04-26exploit/unix/dhcp/rhel_dhcp_client_command_injectionThis module exploits the DynoRoot vulnerability, a flaw in how the NetworkManager integration script included in the DHCP client in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier processes DHCP options. A malicious DHCP server, or an attacker on
CVSS scores for CVE-2018-1111
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.9
|
HIGH | AV:A/AC:M/Au:N/C:C/I:C/A:C |
5.5
|
10.0
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
1.6
|
5.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
1.6
|
5.9
|
Red Hat, Inc. |
CWE ids for CVE-2018-1111
-
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.Assigned by: secalert@redhat.com (Primary)
-
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Secondary)
References for CVE-2018-1111
-
http://www.securityfocus.com/bid/104195
Malformed RequestThird Party Advisory;VDB Entry
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMTTB54QNTPD2SK6UL32EVQHMZP6BUUD/
[SECURITY] Fedora 28 Update: dhcp-4.3.6-20.fc28 - package-announce - Fedora Mailing-Lists
-
https://access.redhat.com/errata/RHSA-2018:1457
RHSA-2018:1457 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://access.redhat.com/errata/RHSA-2018:1455
RHSA-2018:1455 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0
Security fixes in StruxureWare Data Center Expert v7.6.0 - User assistance for StruxureWare Data Center Expert 7.x - Help Center: Support for EcoStruxure IT, StruxureWare for Data Centers, and NetBotz
-
https://www.exploit-db.com/exploits/44652/
DynoRoot DHCP Client - Command InjectionExploit;VDB Entry;Third Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:1456
RHSA-2018:1456 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://access.redhat.com/errata/RHSA-2018:1461
RHSA-2018:1461 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://access.redhat.com/errata/RHSA-2018:1524
RHSA-2018:1524 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://access.redhat.com/errata/RHSA-2018:1454
RHSA-2018:1454 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1111
1567974 – (CVE-2018-1111) CVE-2018-1111 dhcp: Command injection vulnerability in the DHCP client NetworkManager integration scriptIssue Tracking;Vendor Advisory
-
https://access.redhat.com/errata/RHSA-2018:1459
RHSA-2018:1459 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://access.redhat.com/errata/RHSA-2018:1458
RHSA-2018:1458 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://www.exploit-db.com/exploits/44890/
DHCP Client - Command Injection 'DynoRoot' (Metasploit)Exploit;Third Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1040912
Red Hat DCHP NetworkManager Script Component Lets Remote Users on the Local Network Execute Arbitrary Commands with Root Privileges on the Target System - SecurityTrackerThird Party Advisory;VDB Entry
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CDCLLCHYFFXW354HMB5QBXOQOY5BH2EJ/
[SECURITY] Fedora 27 Update: dhcp-4.3.6-10.fc27 - package-announce - Fedora Mailing-Lists
-
https://www.tenable.com/security/tns-2018-10
[R1] TenableCore Web Application Scanner v20180702 Fixes Third-party Vulnerabilities - Security Advisory | Tenable®
-
https://access.redhat.com/errata/RHSA-2018:1460
RHSA-2018:1460 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://access.redhat.com/security/vulnerabilities/3442151
DHCP Client Script Code Execution Vulnerability - CVE-2018-1111 - Red Hat Customer PortalVendor Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IDJA4QRR74TMXW34Q3DYYFPVBYRTJBI7/
[SECURITY] Fedora 26 Update: dhcp-4.3.5-11.fc26 - package-announce - Fedora Mailing-Lists
-
https://access.redhat.com/errata/RHSA-2018:1453
RHSA-2018:1453 - Security Advisory - Red Hat Customer PortalVendor Advisory
Jump to