Vulnerability Details : CVE-2017-5932
The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a command substitution metacharacter.
Vulnerability category: Input validation
Exploit prediction scoring system (EPSS) score for CVE-2017-5932
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-5932
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.6
|
MEDIUM | AV:L/AC:L/Au:N/C:P/I:P/A:P |
3.9
|
6.4
|
NIST |
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2017-5932
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5932
-
http://www.openwall.com/lists/oss-security/2017/02/08/3
oss-security - Re: CVE Request - Code execution vulnerability in GNU/bash v4.4 autocompletionMailing List;Patch;Third Party Advisory
-
https://lists.gnu.org/archive/html/bug-bash/2017-01/msg00034.html
Bash-4.4 Official Patch 7Mailing List;Patch;Vendor Advisory
-
http://www.securityfocus.com/bid/96136
GNU Bash CVE-2017-5932 Multiple Arbitrary Code Execution VulnerabilitiesThird Party Advisory;VDB Entry
-
http://git.savannah.gnu.org/cgit/bash.git/commit/?id=4f747edc625815f449048579f6e65869914dd715
bash.git - bashPatch;Third Party Advisory
Products affected by CVE-2017-5932
- cpe:2.3:a:gnu:bash:4.4:*:*:*:*:*:*:*