Project

General

Profile

Actions
Copy link

Bug #16962

closed
JP JP

Daemon configuration manipulation via CR/LF in ISC DHCP numbered option settings

Bug #16962: Daemon configuration manipulation via CR/LF in ISC DHCP numbered option settings

Added by Jim Pingle about 2 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
DHCP (IPv4)
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

Similar to #16900, the ISC DHCPv4 numbered options itemtype value is not validated on the server side and can allow a user to add arbitrary configuration directives. Unlike the other issue, this is easy to validate against an accepted list of known values.

This appears to be limited to configuration manipulation. The ISC DHCP Daemon runs in a chroot environment and does not have access to a full system environment, so it is unable to execute any commands.

Reported by: @lujiefsi

Files

16962.patch (4.57 KB) 16962.patch Jim Pingle, 07/20/2026 07:26 PM

JP Updated by Jim Pingle about 2 months ago Actions
Copy link
 #1

Fixed in commit 46f98b1a8ce636ae26dc388ab45cc72aae77551f

Patch is attached

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #2

  • Status changed from Feedback to Resolved

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #3

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom