Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2011-0997

High

dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is…

Published Apr 8, 2011 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2011-0997, DSA-2216-1, DSA-2217-1

Key Facts

Patch immediately
  • CVE-2011-0997 is a high-severity vulnerability (CVSS 7.5 v2) affecting Dhcp (Isc), Ubuntu Linux (Canonical), Debian Linux and 10 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
  • EPSS estimates a 85% probability of exploitation in the next 30 days.
  • Fixed versions are available, including dhclient 12:3.0.5-23.el5_6.4, dhclient 12:4.1.1-12.P1.el6_0.4, Dhcp 12:3.0.5-23.el5_6.4.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v2

7.5

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS (30-day exploit likelihood)

85%

Higher than 99.7% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2011-0997 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is provided to dhclient-script.

Affected Products

95 affected entries in total
ProductAffected versionsFixed in
DhcpIsc3.0, 3.0.1, 3.0.1-rc1, 3.0.1-rc10, 3.0.1-rc11, 3.0.1-rc12, 3.0.1-rc13, 3.0.1-rc1412:3.0.5-23.el5_6.4
Ubuntu LinuxCanonical10.04, 10.10, 6.06, 8.04, 9.10n/a
Debian LinuxDebian5.0, 6.0, 7.0n/a
dhcp3debianSee advisory3.1.1-6+lenny5
isc-dhcpdebianSee advisory4.1.1-P1-16.1
8 more affected products in the full CVE brief

Patched Releases

dhclient

12:3.0.5-23.el5_6.4, 12:4.1.1-12.P1.el6_0.4

Dhcp

12:3.0.5-23.el5_6.4, 12:4.1.1-12.P1.el6_0.4, 4.3.3.P1-3.1, 7:3.0.1-10.3_EL3, 7:3.0.1-67.el4

dhcp-client

4.3.3.P1-3.1

dhcp-devel

12:3.0.5-23.el5_6.4, 12:4.1.1-12.P1.el6_0.4, 4.3.3.P1-3.1

dhcp-doc

4.3.3.P1-3.1

dhcp-relay

4.3.3.P1-3.1

dhcp-server

4.3.3.P1-3.1

dhcp3

3.1.1-6+lenny5

isc-dhcp

4.1.1-P1-15+squeeze2, 4.1.1-P1-16.1

libdhcp4client

12:3.0.5-23.el5_6.4

libdhcp4client-devel

12:3.0.5-23.el5_6.4

Timeline

  1. Publicly disclosed

    Apr 8, 2011

  2. Last updated

    Aug 4, 2026

Weakness Type

  • CWE-20 Improper Input Validation
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2011-0997 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo