Command injection in /etc/rc.d/netif

Nami Arjmandi <[email protected]>
Newsgroups gmane.os.freebsd.security.general,gmane.os.freebsd.bugs
Message-ID <CAAdZWauFO+zzzpfE46GE-vtyznvs-Nzp0sVDA9x759NKEi0mkg@mail.gmail.com> 
Hi,

I have found netif script to be susceptible to command injection from both
command line and an arbitrary file name. It's probably happening in
/etc/network.subr but I have not yet been able to patch it.

Example:
service netif start ';id;'
# Command injection from a file name
touch '/tmp/;id;'
service netif start '/tmp/*'
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.