Update dhclient package
A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root privileges on systems using NetworkManager and configured to obtain network configuration using the DHCP protocol.
CVSS3 Base Score 7.5
Public date: 2018-05-15
Apply Unitrends security update v10.28 from 05/21/2018 or later, containing dhclient-4.1.1-53.P1.el6.centos.4
This will correspond to unitrends-security-10.2.0-3.201805211531.
LINK TO ADVISORIES
- https://access.redhat.com/security/cve/cve-2018-1111 https://access.redhat.com/security/vulnerabilities/3442151 https://access.redhat.com/errata/RHSA-2018:1454 https://www.linux.org/threads/centos-announce-cesa-2018-1454-critical-centos-6-dhcp-security-update.17781/ http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1111