Improper input validation in zsh - CVE-2018-7549

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU10856

Improper input validation in zsh - CVE-2018-7549

Published: March 7, 2018 / Updated: March 7, 2018


Vulnerability identifier: #VU10856
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-7549
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the params.c source code file due to improper handling of hash tables. A local attacker can copy an empty hash table with the typeset -p command and cause the service to crash.

Affected software

zsh
Arch Linux
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Server
SUSE Linux
Slackware Linux
Fedora
zsh
zsh-debuginfo
zsh-debugsource

How to mitigate CVE-2018-7549

Install update from vendor's website.

zsh - update to 4.3.6-67.9.8.1
zsh-debuginfo - update to 4.3.6-67.9.8.1
zsh-debugsource - update to 4.3.6-67.9.8.1
zsh - addressed in versions 5.3.1-7.fc26, 5.4.1-2.fc27, 5.4.2-7.fc28

External References

Related Security Bulletins