CVE-2016-0634
HighSummary
The vulnerability in bash 4.3 allows remote authenticated users to execute arbitrary code by injecting shell metacharacters into the hostname, which are expanded when processing the '\h' sequence in the prompt string.
Risk Assessment
An attacker can take control of the system by executing arbitrary commands in the context of the user running bash, leading to compromise of data confidentiality, integrity, and availability.
Recommendation
Update bash to version 4.4 or later, which includes a fix for this vulnerability. As a workaround, restrict access to accounts that can change the hostname.
Other vulnerabilities in bash 4.3
See all- CVE-2017-5932High
The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a command substitution metacharacter.
- CVE-2016-7543High
Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.
- CVE-1999-0491Medium
The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute.
- CVE-1999-1048Medium
Buffer overflow in bash 2.0.0, 1.4.17, and other versions allows local attackers to gain privileges by creating an extremely large directory name, which is inserted into the password prompt via the \w option in the PS1 environmental variable when another user changes into that directory.
- CVE-1999-0234Medium
Bash treats any character with a value of 255 as a command separator, which can lead to unexpected behavior in scripts.
Original NVD description (English source)
The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.