CVE编号
CVE-2018-1111利用情况
暂无补丁情况
官方补丁披露时间
2018-05-18漏洞描述
在Red Hat Enterprise Linux的DHCP客户端软件包中包含的 NetworkManager integration script中发现了命令注入漏洞。恶意DHCP服务器或本地网络上能够欺骗DHCP响应的攻击者可以使用此漏洞在使用NetworkManager的系统上执行具有root权限的任意命令，并配置成使用DHCP协议获取网络。解决建议
用户可联系供应商获得补丁信息：https://access.redhat.com/security/vulnerabilities/3442151
参考链接 |
|
|---|---|
| http://www.securityfocus.com/bid/104195 | |
| http://www.securitytracker.com/id/1040912 | |
| https://access.redhat.com/errata/RHSA-2018:1453 | |
| https://access.redhat.com/errata/RHSA-2018:1454 | |
| https://access.redhat.com/errata/RHSA-2018:1455 | |
| https://access.redhat.com/errata/RHSA-2018:1456 | |
| https://access.redhat.com/errata/RHSA-2018:1457 | |
| https://access.redhat.com/errata/RHSA-2018:1458 | |
| https://access.redhat.com/errata/RHSA-2018:1459 | |
| https://access.redhat.com/errata/RHSA-2018:1460 | |
| https://access.redhat.com/errata/RHSA-2018:1461 | |
| https://access.redhat.com/errata/RHSA-2018:1524 | |
| https://access.redhat.com/security/vulnerabilities/3442151 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1111 | |
| https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+Stru... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://lists.fedoraproject.org/archives/list/[email protected]... | |
| https://www.exploit-db.com/exploits/44652/ | |
| https://www.exploit-db.com/exploits/44890/ | |
| https://www.tenable.com/security/tns-2018-10 |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | redhat | enterprise_virtualization | 4.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | enterprise_virtualization | 4.2 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | redhat | enterprise_virtualization_host | 4.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon linux_2 | dhcp | * |
Up to (excluding) 4.2.5-68.amzn2.1.2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon linux_AMI | dhcp | * |
Up to (excluding) 4.1.1-53.P1.28.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_2 | dhcp | * |
Up to (excluding) 4.2.5-68.amzn2.1.2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | dhcp | * |
Up to (excluding) 4.1.1-53.P1.28.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | centos_6 | dhcp | * |
Up to (excluding) 4.1.1-53.P1.el6.centos.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | centos_7 | dhcp | * |
Up to (excluding) 4.2.5-68.el7.centos.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedoraproject | fedora | 26 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedoraproject | fedora | 27 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedoraproject | fedora | 28 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_26 | dhcp | * |
Up to (excluding) 4.3.5-11.fc26 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_27 | dhcp | * |
Up to (excluding) 4.3.6-10.fc27 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_28 | dhcp | * |
Up to (excluding) 4.3.6-20.fc28 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle linux_6 | dhcp | * |
Up to (excluding) 4.1.1-53.P1.0.1.el6_9.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle linux_7 | dhcp | * |
Up to (excluding) 4.2.5-68.0.1.el7_5.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_6 | dhcp | * |
Up to (excluding) 4.1.1-53.P1.0.1.el6_9.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_7 | dhcp | * |
Up to (excluding) 4.2.5-68.0.1.el7_5.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 6.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 6.4 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 6.5 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 6.6 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 6.7 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 7.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 7.2 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 7.3 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 7.4 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 7.5 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_desktop | 6.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_desktop | 7.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server | 6.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server | 7.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_workstation | 6.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_workstation | 7.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_6 | dhclient | * |
Up to (excluding) 12:4.1.1-53.P1.el6_9.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_7 | dhclient | * |
Up to (excluding) 12:4.2.5-58.el7_4.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_7 | dhclient | * |
Up to (excluding) 12:4.2.5-68.el7_5.1 |
|||||
- 攻击路径 本地
- 攻击复杂度 困难
- 权限要求 无需权限
- 影响范围 有限影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
还没有评论，来说两句吧...