Name	CVE_2011_0997
CVE	CVE-2011-0997 Exploit Pack
NOTES:
-This exploit answers dhcp requests with crafted packets to get commands executed by scripts using the hostname.
For this exploit to work, the target host it must request the hostname over dhcp.

-Tested on Fedora 14, where the commands are executed by GDM(root) when passing the hostname as a variable to mcpp over bash.
Eg: mcpp --DHOST=random;command1;command2; --etc

-Broadcast packets don’t work on Vmware virtual interface so it must be used on physical network.

Repeatability: Infinite
CVE Url: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0997

nessus 36

openvas 32

securityvulns 5

ubuntu 2

checkpoint_advisories 1

redhat 2

veracode 1

debian 2

packetstorm 2

centos 1

debiancve 1

slackware 1

cisa 1

f5 2

oraclelinux 1

cve 1

exploitdb 1

fedora 4

prion 1

exploitpack 1

ubuntucve 2

freebsd 1

cert 1

threatpost 1

vmware 2

gentoo 1

nessus

CentOS 4 / 5 : dhcp (CESA-2011:0428)

2011-04-11 00:00:00

F5 Networks BIG-IP : DHCP Client vulnerability (SOL13219)

2014-10-10 00:00:00

Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 9.0 / 9.1 / current : dhcp (SSA:2011-097-01)

2011-05-28 00:00:00

openvas

CentOS Update for dhclient CESA-2011:0428 centos5 i386

2011-08-09 00:00:00

Debian Security Advisory DSA 2216-1 (isc-dhcp)

2011-05-12 00:00:00

Ubuntu: Security Advisory (USN-1108-2)

2011-05-10 00:00:00

securityvulns

127 ipTIME router models vulnerable to an unauthenticated RCE by sending a crafted DHCP request

2015-07-14 00:00:00

15 TOTOLINK router models vulnerable to multiple RCEs

2015-07-20 00:00:00

ISC DHCP dhclient DHCP client shell unfiltered characters vulnerability

2011-11-16 00:00:00

ubuntu

DHCP vulnerability

2011-04-19 00:00:00

DHCP vulnerability

2011-04-11 00:00:00

checkpoint_advisories

ISC DHCP dhclient Network Configuration Script Command Injection (CVE-2011-0997)

2011-08-16 00:00:00

redhat

(RHSA-2011:0840) Important: dhcp security update

2011-05-31 00:00:00

(RHSA-2011:0428) Important: dhcp security update

2011-04-08 00:00:00

veracode

Arbitrary Code Execution

2020-04-10 00:54:29

debian

[SECURITY] [DSA 2216-1] isc-dhcp security update

2011-04-10 21:55:28

[SECURITY] [DSA 2217-1] dhcp3 security update

2011-04-10 21:58:40

packetstorm

ipTIME DHCP Remote Command Execution

2015-07-06 00:00:00

15 TOTOLINK Routers Remote Command Execution

2015-07-16 00:00:00

centos

dhclient, dhcp, libdhcp4client security update

2011-04-08 21:18:26

debiancve

CVE-2011-0997

2011-04-08 15:17:00

slackware

[slackware-security] dhcp

2011-04-07 05:49:25

cisa

ISC dhclient Vulnerability

2011-04-08 00:00:00

SOL13219 - DHCP Client vulnerability CVE-2011-0997

2011-11-23 00:00:00

K13219 : DHCP Client vulnerability CVE-2011-0997

2013-09-05 00:00:00

oraclelinux

dhcp security update

2011-04-08 00:00:00

cve

CVE-2011-0997

2011-04-08 15:17:00

exploitdb

15 TOTOLINK Router Models - Multiple Remote Code Execution Vulnerabilities

2015-07-16 00:00:00

fedora

[SECURITY] Fedora 15 Update: dhcp-4.2.1-4.P1.fc15

2011-04-15 21:50:51

[SECURITY] Fedora 14 Update: dhcp-4.2.0-21.P2.fc14

2011-04-12 21:33:04

[SECURITY] Fedora 13 Update: dhcp-4.1.2-4.ESV.R2.fc13

2011-04-18 21:21:43

prion

Code injection

2011-04-08 15:17:00

exploitpack

15 TOTOLINK Router Models - Multiple Remote Code Execution Vulnerabilities

2015-07-16 00:00:00

ubuntucve

CVE-2011-0997

2011-04-08 00:00:00

CVE-2011-2716

2012-07-03 00:00:00

freebsd

isc-dhcp-client -- dhclient does not strip or escape shell meta-characters

2011-04-05 00:00:00

cert

ISC dhclient vulnerability

2011-04-05 00:00:00

threatpost

Critical RCE Bug Found Lurking in Avaya VoIP Phones

2019-08-08 20:00:50

vmware

VMware ESX third party updates for Service Console packages glibc and dhcp

2011-07-28 00:00:00

VMware ESX third party updates for Service Console packages glibc and dhcp

2011-07-28 00:00:00

gentoo

ISC DHCP: Denial of service

2013-01-09 00:00:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.971 High

EPSS

Percentile

99.7%

JSON

Related for CVE_2011_0997