Currently I know of three serious attack vectors:

  1. crafted cgi parameters from a web client
  2. dhclient getting crafted hostnames from a DHCP server
  3. restricted SSH users getting full shell access

I realise this may be too wide of a question, but I did not find any such info as of yet, only vague guesses. (Maybe this question belong to the community wiki.)

I am interested mainly in:

  1. client services like the dhclient
  2. server services like the cgi/ssh attack
  3. desktop clients accessing the network like a web browser, ftp client, etc. (i have not heard anything like that yet)
  • 1
    Essentially, anywhere than an attacker can control an environment variable is potentially vulnerable. – Chris Murray Sep 26 '14 at 12:05
  • I am aware of and understand the generics. I am interested in the specific services that are exploitable, and should be watched. – P.Péter Sep 26 '14 at 13:24
  • 1
    Check isc.sans.edu reference links on their front page article as it should help address your query. – zedman9991 Sep 26 '14 at 16:20
  • 1
    This blog post offers the most comprehensive list of attack vectors in actual software which I'm aware of so far. – F30 Sep 28 '14 at 10:39
  • @F30 that blog post was very informative – P.Péter Sep 29 '14 at 7:46