CVE-2011-1930 EXPLOIT
9.8
CRITICAL · CVSS 3.1 · EPSS 20.5% (pctl 97)
Patch early
A public exploit exists.
Description
In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 20.53% — more likely to be exploited than 97% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2019-11-14 |
| Last modified | 2026-06-16 |
Affected (2)
| Vendor | Product |
|---|---|
| debian | debian linux |
| klibc project | klibc |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | klibc 1.5.2 - DHCP Options Processing Remote Shell Command Execution | 2011-05-18 |
References
- http://security.gentoo.org/glsa/glsa-201309-21.xml
- http://www.openwall.com/lists/oss-security/2012/05/22/12
- http://www.securityfocus.com/bid/47924
- https://access.redhat.com/security/cve/cve-2011-1930
- https://security-tracker.debian.org/tracker/CVE-2011-1930
- http://security.gentoo.org/glsa/glsa-201309-21.xml
- http://www.openwall.com/lists/oss-security/2012/05/22/12
- http://www.securityfocus.com/bid/47924
- https://access.redhat.com/security/cve/cve-2011-1930
- https://security-tracker.debian.org/tracker/CVE-2011-1930
→ the Explorer · watch your stack · NVD