CVE-2014-7817
glibc: command execution in wordexp() with WRDE_NOCMD specified
Severity Score
4.6
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".
La función wordexp en GNU C Library (también conocido como glibc) 2.21 no fuerza el indicador WRDE_NOCMD, lo que permite a atacantes dependientes de contexto ejecutar comandos arbitrarios, tal y como fue demostrado por entradas que contienen '$((`...`))'.
It was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2014-10-03 CVE Reserved
- 2014-11-24 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
- CWE-440: Expected Behavior Violation
CAPEC
References (19)
| URL | Tag | Source |
|---|---|---|
| http://linux.oracle.com/errata/ELSA-2015-0016.html | X_refsource_confirm | |
| http://seclists.org/oss-sec/2014/q4/730 | Mailing List |
|
| http://secunia.com/advisories/62100 | Third Party Advisory | |
| http://secunia.com/advisories/62146 | Third Party Advisory | |
| http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html | X_refsource_confirm |
|
| http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html | X_refsource_confirm |
|
| http://www.securityfocus.com/bid/71216 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/98852 | Vdb Entry | |
| https://sourceware.org/bugzilla/show_bug.cgi?id=17625 | X_refsource_confirm | |
| https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commitdiff%3Bh=a39208bd7fb76c1b01c127b4c61f9bfd915bfe7c | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://linux.oracle.com/errata/ELSA-2015-0092.html | 2023-02-13 | |
| http://lists.opensuse.org/opensuse-updates/2015-02/msg00089.html | 2023-02-13 | |
| http://rhn.redhat.com/errata/RHSA-2014-2023.html | 2023-02-13 | |
| http://www.debian.org/security/2015/dsa-3142 | 2023-02-13 | |
| http://www.ubuntu.com/usn/USN-2432-1 | 2023-02-13 | |
| https://security.gentoo.org/glsa/201602-02 | 2023-02-13 | |
| https://sourceware.org/ml/libc-alpha/2014-11/msg00519.html | 2023-02-13 | |
| https://access.redhat.com/security/cve/CVE-2014-7817 | 2015-01-07 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1157689 | 2015-01-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 10.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "10.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 14.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.10" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 7.0 Search vendor "Debian" for product "Debian Linux" and version "7.0" | - |
Affected
| ||||||
| Gnu Search vendor "Gnu" | Glibc Search vendor "Gnu" for product "Glibc" | 2.21 Search vendor "Gnu" for product "Glibc" and version "2.21" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 13.1 Search vendor "Opensuse" for product "Opensuse" and version "13.1" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 13.2 Search vendor "Opensuse" for product "Opensuse" and version "13.2" | - |
Affected
| ||||||