A vulnerability in dhclient allows a rogue DHCP server to inject arbitrary directives into the dhclient lease file by exploiting unescaped embedded double-quotes in the BOOTP file field. When dhclient re-parses the lease file, such as after a system restart, the injected directives are evaluated by dhclient-script, potentially enabling code execution as root.