OS Command Injection in traceroute - CVE-2023-46316

Vulnerability identifier: #VU81451

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-46316

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the tcptraceroute, tracepath, traceproto, and traceroute-nanog wrappers. A remote attacker can trick the victim into executing the traceroutecommand with specially crafted arguments and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

traceroute
IBM Cloud Pak for Multicloud Management
Red Hat OpenShift Container Platform
Amazon Linux AMI
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
openSUSE Leap Micro
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu
Basesystem Module
openSUSE Leap
openEuler
Fedora
RecoverPoint for Virtual Machines
traceroute (Ubuntu package)
traceroute-debugsource
traceroute-debuginfo
traceroute
traceroute-doc
traceroute (Red Hat package)
traceroute-help

Install updates from vendor's website.

traceroute - update to 2.1.3
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
traceroute (Ubuntu package) - update to Ubuntu Pro
traceroute-debugsource - addressed in versions 2.0.19-3.6.1, 2.0.21-150000.3.3.1
traceroute-debuginfo - addressed in versions 2.0.19-3.6.1, 2.0.21-150000.3.3.1
traceroute - addressed in versions 2.0.19-3.6.1, 2.0.21-150000.3.3.1
traceroute-doc - update to 2.1.0-6.0.3
traceroute - update to 2.1.0-6.0.3
traceroute (Red Hat package) - addressed in versions 2.1.0-8.el8, 2.1.0-8.el8_8, 2.1.0-18.el9
traceroute - update to 2.1.2-2
traceroute-debugsource - update to 2.1.2-2
traceroute-debuginfo - update to 2.1.2-2
traceroute-help - update to 2.1.2-2
traceroute - update to 2.1.3-1
traceroute - addressed in versions 2.1.3-1.fc37, 2.1.3-1.fc38, 2.1.3-1.fc39
IBM Cloud Pak for Multicloud Management - update to 2.3 FP11
Red Hat OpenShift Container Platform - addressed in versions 4.13.45, 4.14.32, 4.14.33, 4.16.15, 4.17.0

• https://fossies.org/linux/traceroute/ChangeLog#2.1.3
• https://fossies.org/diffs/traceroute/2.1.2_vs_2.1.3/wrappers/tcptraceroute-diff.html
• https://fossies.org/diffs/traceroute/2.1.2_vs_2.1.3/wrappers/tracepath-diff.html
• https://fossies.org/diffs/traceroute/2.1.2_vs_2.1.3/wrappers/traceproto-diff.html
• https://fossies.org/diffs/traceroute/2.1.2_vs_2.1.3/wrappers/traceroute-nanog-diff.html

• OS command injection in traceroute
• Fedora 39 update for traceroute
• Fedora 38 update for traceroute
• Fedora 37 update for traceroute
• Ubuntu update for traceroute
• SUSE update for traceroute
• SUSE update for traceroute
• openEuler update for traceroute
• Red Hat Enterprise Linux 9 update for traceroute
• Red Hat Enterprise Linux 8 update for traceroute
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Red Hat Enterprise Linux 8 update for traceroute
• Amazon Linux AMI update for traceroute
• Anolis OS update for traceroute
• Dell RecoverPoint for Virtual Machines update for third-party components
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management