Vulnerability Details : CVE-2017-5932
The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a command substitution metacharacter.
Vulnerability category: Input validation
Products affected by CVE-2017-5932
- cpe:2.3:a:gnu:bash:4.4:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-5932
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 6 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-5932
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.6
|
MEDIUM | AV:L/AC:L/Au:N/C:P/I:P/A:P |
3.9
|
6.4
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2017-5932
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5932
-
http://www.openwall.com/lists/oss-security/2017/02/08/3
oss-security - Re: CVE Request - Code execution vulnerability in GNU/bash v4.4 autocompletionMailing List;Patch;Third Party Advisory
-
https://lists.gnu.org/archive/html/bug-bash/2017-01/msg00034.html
Bash-4.4 Official Patch 7Mailing List;Patch;Vendor Advisory
-
http://www.securityfocus.com/bid/96136
GNU Bash CVE-2017-5932 Multiple Arbitrary Code Execution VulnerabilitiesThird Party Advisory;VDB Entry
-
http://git.savannah.gnu.org/cgit/bash.git/commit/?id=4f747edc625815f449048579f6e65869914dd715
bash.git - bashPatch;Third Party Advisory
Jump to