PT-2017-4093 · Zsh+5 · Zsh+5
Oliver Kiddle
·
Publicado
2017-09-04
·
Atualizado
2024-06-15
·
CVE-2018-1083
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Zsh versions prior to 5.4.2-test-1
Description
The issue is related to a buffer overflow in the shell autocomplete functionality. A local unprivileged user can create a specially crafted directory path, leading to code execution in the context of the user who tries to use autocomplete to traverse the mentioned path. If the affected user is privileged, this results in privilege escalation. The exploitation of this issue may allow an attacker to access confidential data, compromise its integrity, and cause a denial of service.
Recommendations
For versions prior to 5.4.2-test-1, update to version 5.4.2-test-1 or later to resolve the issue. As a temporary workaround, consider disabling the autocomplete functionality until a patch is available. Restrict access to sensitive directories to minimize the risk of exploitation.
Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Zsh