Command injection - CVE-2018-1000802
Published: November 10, 2018 / Updated: November 11, 2018
Vulnerability identifier: #VU15794
CSH Severity: Low
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1000802
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to command injection in shutil module (make_archive function). A remote attacker can supply passage of unfiltered user input to the function and inject arbitrary commands to access arbitrary data or cause the service to crash.
Affected software
python2.7 (Debian package)
python2
Opensuse
Fedora
BIG-IP DNS
Dell EMC Data Protection Search
python2
Opensuse
Fedora
BIG-IP DNS
Dell EMC Data Protection Search
How to mitigate CVE-2018-1000802
Install update from vendor's website.
python2.7 (Debian package) - update to 2.7.13-2+deb9u3
BIG-IP DNS - update to 17.5.1
python2 - addressed in versions 2.7.15-3.fc27, 2.7.15-3.fc28, 2.7.15-10.fc29
Dell EMC Data Protection Search - update to 18.2.1
BIG-IP DNS - update to 17.5.1
python2 - addressed in versions 2.7.15-3.fc27, 2.7.15-3.fc28, 2.7.15-10.fc29
Dell EMC Data Protection Search - update to 18.2.1