Input validation error in Bash - CVE-2017-5932
Published: March 27, 2017 / Updated: August 8, 2020
Vulnerability identifier: #VU39367
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-5932
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local authenticated user to execute arbitrary code.
The path autocompletion feature in Bash 4.4 allows local users to gain privileges via a crafted filename starting with a " (double quote) character and a command substitution metacharacter.
Affected software
Bash
Netcool Operations Insight
IBM Cloud Transformation Advisor
Watson Studio on Cloud Pak for Data
Netcool Operations Insight
IBM Cloud Transformation Advisor
Watson Studio on Cloud Pak for Data
How to mitigate CVE-2017-5932
Install update from vendor's website.
Netcool Operations Insight - update to 1.6.8
IBM Cloud Transformation Advisor - update to 3.10.0
Watson Studio on Cloud Pak for Data - addressed in versions 4.8.7, 5.1.0
IBM Cloud Transformation Advisor - update to 3.10.0
Watson Studio on Cloud Pak for Data - addressed in versions 4.8.7, 5.1.0