openSUSE Security Update: dhcp security update ______________________________________________________________________________ Announcement ID: openSUSE-SU-2011:0320-1 Rating: important References: #673792 #675052 Cross-References: CVE-2011-0997 Affected Products: openSUSE 11.3 openSUSE 11.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. It includes one version update. Description: A rogue dhcp server could instruct clients to use a host name that contains shell meta characters. Since many scripts in the system do not expect unusal characters in the system's host name the dhcp client needs to sanitize the host name offered by the server (CVE-2011-0997). Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.3: zypper in -t patch dhcp-4314 - openSUSE 11.2: zypper in -t patch dhcp-4314 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.3 (i586 x86_64) [New Version: 4.1.2.ESV.1]: dhcp-4.1.2.ESV.1-0.6.1 dhcp-client-4.1.2.ESV.1-0.6.1 dhcp-devel-4.1.2.ESV.1-0.6.1 dhcp-doc-4.1.2.ESV.1-0.6.1 dhcp-relay-4.1.2.ESV.1-0.6.1 dhcp-server-4.1.2.ESV.1-0.6.1 - openSUSE 11.2 (i586 x86_64): dhcp-3.1.2p1-4.10.1 dhcp-client-3.1.2p1-4.10.1 dhcp-devel-3.1.2p1-4.10.1 dhcp-relay-3.1.2p1-4.10.1 dhcp-server-3.1.2p1-4.10.1 References: http://support.novell.com/security/cve/CVE-2011-0997.html https://bugzilla.novell.com/673792 https://bugzilla.novell.com/675052