CVE-1999-1048
MediumExploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Buffer overflow in bash 2.0.0, 1.4.17, and other versions allows local attackers to gain privileges by creating an extremely large directory name, which is inserted into the password prompt via the \w option in the PS1 environmental variable when another user changes into that directory.
Risk Assessment
Attackers can gain unauthorized privileges, potentially leading to serious security breaches in the system.
Recommendation
It is recommended to update to the latest version of bash and restrict access to the PS1 variable for unauthorized users.
Other vulnerabilities in bash
See all- CVE-2016-0634High
The vulnerability in bash 4.3 allows remote authenticated users to execute arbitrary code by injecting shell metacharacters into the hostname, which are expanded when processing the '\h' sequence in the prompt string.
- CVE-2017-5932High
The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a command substitution metacharacter.
- CVE-2016-7543High
Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.
- CVE-1999-0491Medium
The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute.
- CVE-1999-0234Medium
Bash treats any character with a value of 255 as a command separator, which can lead to unexpected behavior in scripts.
Original NVD description (English source)
Buffer overflow in bash 2.0.0, 1.4.17, and other versions allows local attackers to gain privileges by creating an extremely large directory name, which is inserted into the password prompt via the \w option in the PS1 environmental variable when another user changes into that directory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS