Command injection in Thrift - CVE-2016-5397

 

Command injection in Thrift - CVE-2016-5397

Published: March 20, 2018 / Updated: March 21, 2018


Vulnerability identifier: #VU11178
CSH Severity: High
CVSS v4: 9.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2016-5397
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.

The weakness exists in the ft_go_generator.cc:format_go_output()function due to command injection. A remote attacker can submit a specially crafted service name through an external formatting tool and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Affected software

Thrift
JBoss Data Virtualization
IBM Security Guardium
Fuse

How to mitigate CVE-2016-5397

Update to version 0.10.0.

JBoss Data Virtualization - update to 6.4.8
Fuse - update to 7.1.0

External References

Related Security Bulletins