Veracode Vulnerability DatabaseVERACODE:17705Privilege Escalation
8.4 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
Bash is vulnerable to privilege escalation. This allows to local authenticated user to inject arbitrary commands via crafted SHELLOPTS and PS4 environment variables leading to data modification and disclosure of information.
References
rhn.redhat.com/errata/RHSA-2017-0725.html
www.openwall.com/lists/oss-security/2016/09/26/9
www.securityfocus.com/bid/93183
www.securitytracker.com/id/1037812
access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.9_Release_Notes/index.html
access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.9_Technical_Notes/index.html
access.redhat.com/errata/RHSA-2017:0725
access.redhat.com/errata/RHSA-2017:1931
access.redhat.com/security/updates/classification/#moderate
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05388115
lists.fedoraproject.org/archives/list/[email protected]/message/F7XOQSHU63Y357NHU5FPTFBM6I3YOCQB/
lists.fedoraproject.org/archives/list/[email protected]/message/OU3C756YPHDAAPFX76UGZBAQQQ5UMHS5/
lists.fedoraproject.org/archives/list/[email protected]/message/Z2VRBSIPZDZ75ZQ2DLITHUIDW4W26KVR/
lists.gnu.org/archive/html/bug-bash/2016-09/msg00018.html
security.gentoo.org/glsa/201701-02
Related
8.4 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C