Authorization bypass in zsh - CVE-2018-13259

Vulnerability identifier: #VU14701

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-13259

CWE-ID: CWE-862

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to execute a program without proper authorization on the target system.

The vulnerability exists due to improper truncating of shebang (#!) lines that exceed 64 characters. A local attacker can access the shell and submit a shebang line longer than 64 characters, cause the software to make an execve() call to a program name that is a substring of the intended one and execute a program without proper authorization on the system.

zsh
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Opensuse
Fedora
zsh
zsh-debuginfo
zsh-debugsource

Update to version 5.6.

zsh - update to 5.6
zsh - addressed in versions 4.3.6-67.9.8.1, 5.0.5-6.12.2
zsh-debuginfo - addressed in versions 4.3.6-67.9.8.1, 5.0.5-6.12.2
zsh-debugsource - addressed in versions 4.3.6-67.9.8.1, 5.0.5-6.12.2
zsh - addressed in versions 5.4.1-4.fc27, 5.5.1-2.fc28, 5.6.2-1.fc29

• https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d

• Authorization bypass in zsh
• OpenSUSE Linux update for zsh
• OpenSUSE Linux update for zsh
• Gentoo update for Zsh
• Red Hat update for zsh
• Amazon Linux AMI update for zsh
• SUSE update for zsh
• SUSE update for zsh
• Fedora 29 update for zsh
• Fedora 28 update for zsh
• Fedora 27 update for zsh