Security flaw in Red Hat could allow full root access.
Red Hat patched a vulnerability affecting the DHCP client packages that shipped with Red Hat Enterprise Linux 6 and 7. It could give a hacker root access and full control over enterprise endpoints. An alert was issued Wednesday from US-CERT. The critical flaw would allow hackers to use malicious DHCP server responses to execute arbitrary commands on target systems over the local network if those systems used NetworkManager and were configured to obtain dynamic IP addresses. A hack would take advantage of the way the DHCP protocol is used to dynamically assign IP addresses to computers, the fact that the endpoint clients essentially broadcast out a query over the local network to obtain an address from a DHCP server.
When a computer connects to a network, it asks for an IP address and the DHCP server responds by giving it one. That response could contain a malicious reply from the server, so that the system gets back not just an IP address, but also a malicious code. The vulnerability that was patched would allow that code to execute, so that a hacker could run commands off the server to that system including getting root access.
A possible attack could be to open a reverse remote terminal, allowing the hacker to have almost complete control over the target machine. At a minimum, a denial of service would be practical, but full remote control over the system could be obtained based on the hacker's knowledge of the system and ability to create rogue processes, services, and / or tamper with data files. The vulnerability could be allowed to spread; a compromised web server could spread to the MySQL server if they are both on the same network. A hacker may be able to compromise the legitimate DHCP server in order to send out the malicious code in the first place. They could set up a fake node on the network to masquerade as a legitimate DHCP server, sending out malicious, spoofed responses to normal network addressing queries. In both cases, the hacker would need to be on the same local area network as the targeted systems in order to take advantage of the flaw.
This flaw can be remotely exploitable if the hacker gains remote access to a local DHCP server through a separate vulnerability. This flaw doesn't affect many home users since they don't usually run Linux but Enterprise users should be worried, especially given how mobile the workforce is today. A computer running a RedHat based OS, including CentOS, Fedora or RHEL, can be hacked by connecting to Wi-Fi on an airplane or at a hotel or other public space, or if it's hooked up to a compromised network in a corporate environment.
This just brings a spotlight on the dangers of using shell which is a commonly used programming language on Linux systems. It is proned to allowing these kinds of flaws to be coded. It's easy to make a mistake in shell that can lead to this kind of vulnerability. There are vulnerabilities like this from time to time, developers should keep that in mind and reduce their reliance on shell. The patches for the client packages for Red Hat Enterprise Linux 6 and 7 can be accessed here. There are no patches so far for Fedora and CentOS projects.