SUSE update for zsh

Published: 2022-03-14

Risk	Low
Patch available	YES
Number of vulnerabilities	12
CVE-ID	CVE-2014-10070 CVE-2014-10071 CVE-2014-10072 CVE-2016-10714 CVE-2017-18205 CVE-2017-18206 CVE-2018-0502 CVE-2018-1071 CVE-2018-1083 CVE-2018-13259 CVE-2018-7549 CVE-2019-20044
CWE-ID	CWE-264 CWE-120 CWE-193 CWE-476 CWE-862 CWE-121 CWE-20 CWE-273
Exploitation vector	Local
Public exploit	Public exploit code for vulnerability #7 is available. Public exploit code for vulnerability #10 is available. Public exploit code for vulnerability #12 is available.
Vulnerable software Subscribe	SUSE Linux Enterprise Server Operating systems & Components / Operating system SUSE Linux Enterprise Point of Sale Operating systems & Components / Operating system SUSE Linux Enterprise Debuginfo Operating systems & Components / Operating system zsh-debugsource Operating systems & Components / Operating system package or component zsh-debuginfo Operating systems & Components / Operating system package or component zsh Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 12 vulnerabilities.

1) Privilege escalation

EUVDB-ID: #VU10872

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-10070

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to improper security restrictions when initial evaluating the values of imported integer variables. A local attacker can gain elevated privileges.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU10871

Risk: Low

CVSSv3.1: 3.5 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-10071

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the exec.c source code file due to buffer overflow. A local attacker can send long file descriptors (fds), in the >& fd syntax, trigger memory corruption and cause the service to crash.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU10874

Risk: Low

CVSSv3.1: 3.5 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-10072

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a local unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the utils.c source code file due to buffer overflow. A local attacker can trigger memory corruption and cause the service to crash.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Off-by-one error

EUVDB-ID: #VU10862

Risk: Low

CVSSv3.1: 3.5 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10714

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

Description

The vulnerability allows a local unauthenticated attacker to cause DoS condition on the target system.

The weakness exists due to an off-by-one error. A local attacker can use undersized buffers for PATH_MAX characters and cause the service to crash.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) NULL pointer dereference

EUVDB-ID: #VU10869

Risk: Low

CVSSv3.1: 3.5 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-18205

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local unauthenticated attacker to cause DoS condition on the target system.

The weakness exists due to a NULL pointer dereference when processing a cd command while in sh compatibility mode. A local attacker can cause the service to crash.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU10855

Risk: Low

CVSSv3.1: 3.5 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-18206

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the utils.c source code file due to insufficient checks on buffer lengths for symlink expansion. A local attacker can send specially crafted input, trigger memory corruption and cause the service to crash.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Authorization bypass

EUVDB-ID: #VU14702

Risk: Low

CVSSv3.1: 7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-0502

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a local attacker to execute a program without proper authorization on the target system.

The vulnerability exists due to improper handling of the beginning of a shebang (#!) script file. A local attacker can execute a shebang script file that submits malicious input, pass content from the second line of the file to execve() and execute a program without proper authorization on the system.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

8) Stack-based buffer overflow

EUVDB-ID: #VU12187

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1071

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DOS condition on the target system.

The weakness exists in the exec.c:hashcmd() function due to stack-based buffer overflow. A local attacker can trigger memory corruption and cause the service to crash.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Buffer overflow

EUVDB-ID: #VU11349

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1083

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in the compctl.c source code file due to insufficient bounds checking on the PATH_MAX-sized buffer used for file completion candidates. A local attacker can create a malicious directory path, trick the victim into using the autocomplete functionality to traverse the path, trigger buffer overflow and execute arbitrary code with root privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Authorization bypass

EUVDB-ID: #VU14701

Risk: Low

CVSSv3.1: 7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-13259

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a local attacker to execute a program without proper authorization on the target system.

The vulnerability exists due to improper truncating of shebang (#!) lines that exceed 64 characters. A local attacker can access the shell and submit a shebang line longer than 64 characters, cause the software to make an execve() call to a program name that is a substring of the intended one and execute a program without proper authorization on the system.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

11) Improper input validation

EUVDB-ID: #VU10856

Risk: Low

CVSSv3.1: 3.5 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-7549

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the params.c source code file due to improper handling of hash tables. A local attacker can copy an empty hash table with the typeset -p command and cause the service to crash.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Improper Check for Dropped Privileges

EUVDB-ID: #VU26210

Risk: Low

CVSSv3.1: 7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-20044

CWE-ID: CWE-273 - Improper Check for Dropped Privileges

Exploit availability: Yes

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to Zsh fails to overwrite the saved uid, so the original privileges, dropped by the --no-PRIVILEGED option, can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid(). A local user can execute arbitrary commands on the system with elevated privileges.

Mitigation

Update the affected package zsh to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server: 11-SP4-LTSS-EXTREME-CORE

SUSE Linux Enterprise Point of Sale: 11-SP3

SUSE Linux Enterprise Debuginfo: 11-SP3 - 11-SP4

zsh-debugsource: before 4.3.6-67.9.8.1

zsh-debuginfo: before 4.3.6-67.9.8.1

zsh: before 4.3.6-67.9.8.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-202214910-1/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.