PT-2017-18538 · Renci · Irods

Publicado 2017-05-05 · Atualizado 2019-10-03 · CVE-2017-8799

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iRODS versions prior to 4.1.11 iRODS versions prior to 4.2.1

Description The issue allows execution of untrusted input via igetwild in iRODS, enabling other users, potentially anonymous, to execute remote shell commands through iRODS virtual pathnames. This can be exploited by retrieving a virtual iRODS pathname containing a semicolon via igetwild, which, being a Bash script, executes the part of the pathname following the semicolon in the user's shell.

Recommendations For versions prior to 4.1.11, update to version 4.1.11 or later. For versions prior to 4.2.1, update to version 4.2.1 or later.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2017-8799

Produtos afetados

Irods

Referências · 3

• https://github.com/irods/irods/issues/3452 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2017-8799 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-8799 · Aviso do Fabricante