Authorization bypass in zsh - CVE-2018-0502

Vulnerability identifier: #VU14702

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-0502

CWE-ID: CWE-862

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to execute a program without proper authorization on the target system.

The vulnerability exists due to improper handling of the beginning of a shebang (#!) script file. A local attacker can execute a shebang script file that submits malicious input, pass content from the second line of the file to execve() and execute a program without proper authorization on the system. 

zsh
Gentoo Linux
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP
Opensuse
Fedora
zsh
zsh-debuginfo
zsh-debugsource

Update to version 5.6.

zsh - update to 5.6
zsh - addressed in versions 4.3.6-67.9.8.1, 5.0.5-6.12.2
zsh-debuginfo - addressed in versions 4.3.6-67.9.8.1, 5.0.5-6.12.2
zsh-debugsource - addressed in versions 4.3.6-67.9.8.1, 5.0.5-6.12.2
zsh - addressed in versions 5.4.1-4.fc27, 5.5.1-2.fc28, 5.6.2-1.fc29

• https://sourceforge.net/p/zsh/code/ci/1c4c7b6a4d17294df028322b70c53803a402233d

• Authorization bypass in zsh
• OpenSUSE Linux update for zsh
• OpenSUSE Linux update for zsh
• Gentoo update for Zsh
• SUSE update for zsh
• SUSE update for zsh
• Fedora 29 update for zsh
• Fedora 28 update for zsh
• Fedora 27 update for zsh