PT-2015-1273 · Red Hat+1 · Setroubleshoot+2

Sebastian Krahmer · Published 2015-03-26 · Updated 2023-02-13 · CVE-2015-1815

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions setroubleshoot versions prior to 3.2.22

Description The issue is related to incorrect file name handling, which can be exploited by remote attackers to execute arbitrary commands by adding shell metacharacters to file names. This is specifically related to the get rpm nvr by file path temporary function in util.py.

Recommendations For versions prior to 3.2.22, update to version 3.2.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the get rpm nvr by file path temporary function in util.py until a patch is available.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2015-10303

CESA-2015_0729

CVE-2015-1815

RHSA-2015:0729

RHSA-2015_0729

Affected Products

Centos

Red Hat

Setroubleshoot

References · 15

• 🔥 https://github.com/stealth/troubleshooter · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1206050 · Exploit
• 🔥 https://exploit-db.com/exploits/36564 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2015/03/26/1 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1203352 · Exploit
• http://rhn.redhat.com/errata/RHSA-2015-0729.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154147.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154444.html · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154427.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10303 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-1815 · Security Note
• https://linux.oracle.com/errata/ELSA-2015-0729.html · Vendor Advisory
• http://osvdb.org/119966 · Note
• http://securityfocus.com/bid/73374 · Note
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1815 · Note