dhclient, dhcp, libdhcp4client security update

CentOS Errata and Security Advisory CESA-2011:0428

The Dynamic Host Configuration Protocol (DHCP) is a protocol that allows
individual devices on an IP network to get their own network configuration
information, including an IP address, a subnet mask, and a broadcast
address.

It was discovered that the DHCP client daemon, dhclient, did not
sufficiently sanitize certain options provided in DHCP server replies, such
as the client hostname. A malicious DHCP server could send such an option
with a specially-crafted value to a DHCP client. If this option’s value was
saved on the client system, and then later insecurely evaluated by a
process that assumes the option is trusted, it could lead to arbitrary code
execution with the privileges of that process. (CVE-2011-0997)

Red Hat would like to thank Sebastian Krahmer of the SuSE Security Team for
reporting this issue.

All dhclient users should upgrade to these updated packages, which contain
a backported patch to correct this issue.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2011-April/079442.html
https://lists.centos.org/pipermail/centos-announce/2011-April/079443.html
https://lists.centos.org/pipermail/centos-announce/2011-April/079457.html
https://lists.centos.org/pipermail/centos-announce/2011-April/079458.html

Affected packages:
dhclient
dhcp
dhcp-devel
libdhcp4client
libdhcp4client-devel

Upstream details at:
https://access.redhat.com/errata/RHSA-2011:0428