保护你的 Fedora 系统免受这个 DHCP 漏洞
dhcp 安全
![](/data/attachment/album/201806/02/062337ncbcmjgkp9ltm404.jpg)


前几天在 `dhcp-client` 中发现并披露了一个严重的安全漏洞。此 DHCP 漏洞会对你的系统和数据造成高风险，尤其是在使用不受信任的网络，如非你拥有的 WiFi 接入点时。


动态主机控制协议（DHCP）能让你的系统从其加入的网络中获取配置。你的系统将请求 DHCP 数据，并且通常是由路由器等服务器应答。服务器为你的系统提供必要的数据以进行自我配置。例如，你的系统如何在加入无线网络时正确进行网络配置。


但是，本地网络上的攻击者可能会利用此漏洞。使用在 NetworkManager 下运行的 `dhcp-client` 脚本中的漏洞，攻击者可能能够在系统上以 root 权限运行任意命令。这个 DHCP 漏洞使你的系统和数据处于高风险状态。该漏洞已分配 CVE-2018-1111，并且有 [Bugzilla 来跟踪 bug](https://bugzilla.redhat.com/show_bug.cgi?id=1567974)。


### 防范这个 DHCP 漏洞


新的 dhcp 软件包包含了 Fedora 26、27 和 28 以及 Rawhide 的修复程序。维护人员已将这些更新提交到 updates-testing 仓库。对于大多数用户而言，它们应该在这篇文章的大约一天左右的时间内在稳定仓库出现。所需的软件包是：


* Fedora 26: dhcp-4.3.5-11.fc26
* Fedora 27: dhcp-4.3.6-10.fc27
* Fedora 28: dhcp-4.3.6-20.fc28
* Rawhide: dhcp-4.3.6-21.fc29


#### 更新稳定的 Fedora 系统


要在稳定的 Fedora 版本上立即更新，请[使用 sudo](https://fedoramagazine.org/howto-use-sudo/) 运行此命令。如有必要，请在提示时输入你的密码：



```
sudo dnf --refresh --enablerepo=updates-testing update dhcp-client

```

之后，使用标准稳定仓库进行更新。要从稳定的仓库更新 Fedora 系统，请使用以下命令：



```
sudo dnf --refresh update dhcp-client

```

#### 更新 Rawhide 系统


如果你的系统是 Rawhide，请使用以下命令立即下载和更新软件包：



```
mkdir dhcp && cd dhcp
koji download-build --arch={x86_64,noarch} dhcp-4.3.6-21.fc29
sudo dnf update ./dhcp-*.rpm

```

在每日的 Rawhide compose 后，只需运行 `sudo dnf update` 即可获取更新。


### Fedora Atomic Host


针对 Fedora Atomic Host 的修复程序版本为 28.20180515.1。要获得更新，请运行以下命令：



```
atomic host upgrade -r

```

此命令将重启系统以应用升级。




---


via: <https://fedoramagazine.org/protect-fedora-system-dhcp-flaw/>


作者：[Paul W. Frields](https://fedoramagazine.org/author/pfrields/) 选题：[lujun9972](https://github.com/lujun9972) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
A critical security vulnerability was discovered and disclosed earlier today in *dhcp-client*. This DHCP flaw carries a high risk to your system and data, especially if you use untrusted networks such as a WiFi access point you don’t own. Read more here for how to protect your Fedora system.


Dynamic Host Control Protocol (DHCP) allows your system to get configuration from a network it joins. Your system will make a request for DHCP data, and typically a server such as a router answers. The server provides the necessary data for your system to configure itself. This is how, for instance, your system configures itself properly for networking when it joins a wireless network.

However, an attacker on the local network may be able to exploit this vulnerability. Using a flaw in a dhcp-client script that runs under NetworkManager, the attacker may be able to run arbitrary commands with root privileges on your system. This DHCP flaw puts your system and your data at high risk. The flaw has been assigned CVE-2018-1111 and has a [Bugzilla tracking bug](https://bugzilla.redhat.com/show_bug.cgi?id=1567974).

## Guarding against this DHCP flaw

New *dhcp* packages contain fixes for Fedora 26, 27, and 28, as well as Rawhide. The maintainers have submitted these updates to the *updates-testing* repositories. They should show up in stable repos within a day or so of this post for most users. The desired packages are:

- Fedora 26:
*dhcp-4.3.5-11.fc26* - Fedora 27:
*dhcp-4.3.6-10.fc27* - Fedora 28:
*dhcp-4.3.6-20.fc28* - Rawhide:
*dhcp-4.3.6-21.fc29*

### Updating a stable Fedora system

To update immediately on a stable Fedora release, use this command [with sudo](https://fedoramagazine.org/howto-use-sudo/). Type your password at the prompt, if necessary:

sudo dnf --refresh --enablerepo=updates-testing update dhcp-client

Later, use the standard stable repos to update. To update your Fedora system from the stable repos, use this command:

sudo dnf --refresh update dhcp-client

### Updating a Rawhide system

If your system is on Rawhide, use these commands to download and update the packages immediately:

mkdir dhcp && cd dhcp koji download-build --arch={x86_64,noarch} dhcp-4.3.6-21.fc29 sudo dnf update ./dhcp-*.rpm

After the nightly Rawhide compose, simply run *sudo dnf update* to get the update.

## Fedora Atomic Host

The fixes for Fedora Atomic Host are in ostree version 28.20180515.1. To get the update, run this command:

atomic host upgrade -r

This command reboots your system to apply the upgrade.

Photo by [Markus Spiske](https://unsplash.com/photos/FXFz-sW0uwo?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText) on [Unsplash](https://unsplash.com/search/photos/protect?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText).

## alick

It seems to me we will need to reboot after updating. Can anyone confirm?

## Georg Sauthoff

You have to make sure that any running dhclient process is terminated. Thus, a

is sufficient. The network-manager then automatically restarts the dhclient, after a short timeout.

A reboot is an alternative way to make sure that the update is effective.

## Flo

https://apps.fedoraproject.org/packages/dhcp is confusing. The fixed version has been pushed to

already. However, if right now people add

to their dnf command they actually get an older version that still contains the flaw.

## Paul W. Frields

@Flo: This could happen if your mirror is out of sync. You can try waiting a short while for the sync to catch up, or pull packages from another mirror.

## Jared Busch

Already in

for Fedora 28

## murph

The rawhide instructions didn’t quite work. Got some great help on IRC, they directed me to https://koji.fedoraproject.org/koji/buildinfo?buildID=1081949 where I downloaded the common and libs packages, then got everything to install fine.

A few rough edges when installing brand new patches on Rawhide should be expected, so no problem.

## Costa A.

A “dnf upgrade -y” today was enough to get the updated dhcp-client version.

## Eddie G. O'Connor Jr.

Just wanna say “Thanks” to all the folks who help keep my Fedora systems up and running smoothly. Will be applying this update to my systems just as soon as we get power restored. (High winds knocked down trees which took out the power lines in my neighborhood!) SO by then?…(Fri. evening!) everything should be in place for a smooth update for me!

Fedora? ROCKS!!!

## Eddie G. O'Connor Jr.

Also…..dows anyone know if this will affect CEntOS servers as well? Wondering if I have to pull them offline and perform updates on ’em too?

## Eduard Lucena

Yes, it affects RHEL, CentOS and Fedora.

## Hans

I’d be surprised if your server would use dhcp-client to receive an IP address.

## Michael J Gruber

The rpm package name is dhcp-client, not dhcp.

(dhcp is the source package from which various dhcp related rpm packages are built – including dhcp-client, but not dhcp.)

## Paul W. Frields

@Michael: The dhcp-client package comes from the dhcp source package. It also requires dhcp-common and dhcp-libs. That is why the overall dhcp source package version is used in the article.

## Michael J Gruber

@Paul Yes, that is what I wrote. We are in complete agreement 🙂

It’s just that the natural “rpm -q dhcp” does not work as a check whether you are affected.

## Michael A Hawkins

Some of us are forced to run older versions of Fedora. Any chance this thread could include the offending text from the script and some ways to edit it away or improve it?

## Mike

Is this working for Fedora 25?