Design/Logic Flaw

🗓️ 30 Mar 2015 14:59:00Reported by PRIOn knowledge baseType

Design/Logic Flaw in get_rpm_nvr_by_file_path_temporary function in setroubleshoot before 3.2.22 allows remote command execution via shell metacharacters.

Reporter	Title	Published	Views	Family All 37
BDU FSTEC	The vulnerability of the SELinux access control system, allowing a perpetrator to execute arbitrary commands	15 Jun 201500:00	–	bdu_fstec
Tenable Nessus	CentOS 5 / 6 / 7 : setroubleshoot (CESA-2015:0729)	27 Mar 201500:00	–	nessus
Tenable Nessus	Fedora 22 : setroubleshoot-3.2.22-1.fc22 (2015-4792)	3 Apr 201500:00	–	nessus
Tenable Nessus	Fedora 20 : setroubleshoot-3.2.17-2.fc20 (2015-4833)	9 Apr 201500:00	–	nessus
Tenable Nessus	Fedora 21 : setroubleshoot-3.2.22-1.fc21 (2015-4838)	9 Apr 201500:00	–	nessus
Tenable Nessus	MiracleLinux 4 : setroubleshoot-3.0.47-6.1.0.1.AXS4 (AXSA:2015-107:01)	16 Jan 202600:00	–	nessus
Tenable Nessus	Oracle Linux 6 / 7 : setroubleshoot (ELSA-2015-0729)	27 Mar 201500:00	–	nessus
Tenable Nessus	RHEL 5 / 6 / 7 : setroubleshoot (RHSA-2015:0729)	27 Mar 201500:00	–	nessus
Tenable Nessus	Scientific Linux Security Update : setroubleshoot on SL5.x, SL6.x, SL7.x i386/x86_64 (20150326)	27 Mar 201500:00	–	nessus
Cent OS	setroubleshoot security update	26 Mar 201523:21	–	centos

Source	Link
openwall	www.openwall.com/lists/oss-security/2015/03/26/1
github	www.github.com/stealth/troubleshooter
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
rhn	www.rhn.redhat.com/errata/RHSA-2015-0729.html
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
lists	www.lists.fedoraproject.org/pipermail/package-announce/2015-March/154147.html
lists	www.lists.fedoraproject.org/pipermail/package-announce/2015-April/154444.html
lists	www.lists.fedoraproject.org/pipermail/package-announce/2015-April/154427.html
exploit-db	www.exploit-db.com/exploits/36564/
osvdb	www.osvdb.org/119966

13 Feb 2023 00:47Current

8High risk

Vulners AI Score8

EPSS0.16335