Command injection in /etc/rc.d/netif

Hi,

I have found netif script to be susceptible to command injection from both
command line and an arbitrary file name. It's probably happening in
/etc/network.subr but I have not yet been able to patch it.

Example:
service netif start ';id;'
# Command injection from a file name
touch '/tmp/;id;'
service netif start '/tmp/*'