CVE-2014-7817
CVSS V2 Medium 4.6
CVSS V3 None
Description
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".
Overview
- CVE ID
- CVE-2014-7817
- Assigner
- secalert@redhat.com
- Vulnerability Status
- Modified
- Published Version
- 2014-11-24T15:59:01
- Last Modified Date
- 2023-02-13T00:42:21
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:* | 1 | OR | ||
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* | 1 | OR | ||
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | 1 | OR | ||
| cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:gnu:glibc:2.21:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:L/AC:L/Au:N/C:P/I:P/A:P
- Access Vector
- LOCAL
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 4.6
- Severity
- MEDIUM
- Exploitability Score
- 3.9
- Impact Score
- 6.4
References
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2014-7817 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7817 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 17:55:17 | Added to TrackCVE | |||
| 2022-12-02 02:25:35 | 2014-11-24T15:59Z | 2014-11-24T15:59:01 | CVE Published Date | updated |
| 2022-12-02 02:25:35 | 2018-10-30T16:27:35 | CVE Modified Date | updated | |
| 2022-12-02 02:25:35 | Modified | Vulnerability Status | updated | |
| 2023-02-02 21:04:42 | 2023-02-02T20:18:32 | CVE Modified Date | updated | |
| 2023-02-02 21:04:42 | The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))". | It was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application. | Description | updated |
| 2023-02-02 21:04:50 | References | updated | ||
| 2023-02-13 01:05:29 | 2023-02-13T00:42:21 | CVE Modified Date | updated | |
| 2023-02-13 01:05:30 | It was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application. | The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))". | Description | updated |