OS Command Injection in less - CVE-2024-32487

Vulnerability identifier: #VU88533

CSH Severity: Medium

CVSS v4 BT: 4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-32487

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when handling newline characters in the filename in filename.c. A remote attacker can trick the victim to pass a specially crafted filename to the affected command and execute arbitrary OS commands on the system.

less
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Debian Linux
Oracle Linux
Amazon Linux AMI
Oracle Solaris
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
openSUSE Leap Micro
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Anolis OS
SUSE Enterprise Storage
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Ubuntu
Slackware Linux
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
Basesystem Module
openSUSE Leap
openEuler
Fedora
Dell Data Protection Central
PowerProtect DP Series Appliance (IDPA)
PowerStore X
PowerStore T
IBM Cloud Pak for Watson AIOps
Storage Resource Manager
EMC Cloud Tiering Appliance
Voice Gateway
SmartFabric Storage Software
LANTIME Operating System Firmware (LTOS)
Cryostat
Red Hat Advanced Cluster Management for Kubernetes
Red Hat OpenShift Dev Spaces
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
OpenShift Logging
Dell Secure Connect Gateway
Red Hat Migration Toolkit for Applications
Session Smart Router
IBM Power Hardware Management Console (HMC)
RecoverPoint for Virtual Machines
IBM Qradar SIEM
Juniper Secure Analytics (JSA)
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
less (Ubuntu package)
less-debuginfo
less
less-debugsource
less (Red Hat package)
less-doc
less (Debian package)
less-help
OpenShift API for Data Protection (OADP)
Red Hat OpenShift GitOps
IBM QRadar Network Packet Capture
Multicluster Engine for Kubernetes
Dell EMC Storage Monitoring and Reporting (SMR)

Install updates from vendor's website.

Oracle Solaris - update to 11.4 SRU 71
Voice Gateway - update to 1.0.8.12
SmartFabric Storage Software - update to 1.4.3
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
LANTIME Operating System Firmware (LTOS) - update to 7.08.021
Juniper Secure Analytics (JSA) - update to 7.5.0 UP9 IF02
IBM Qradar SIEM - update to 7.5.0 Update Pack 9 IF01
less (Ubuntu package) - addressed in versions Ubuntu Pro, 551-1ubuntu0.3, 590-1ubuntu0.22.04.3, 590-2ubuntu0.23.10.2, 590-2ubuntu2.1
OpenShift API for Data Protection (OADP) - update to 1.3.2
Migration Toolkit for Containers - update to 1.8.4
Red Hat OpenShift GitOps - addressed in versions 1.11.6, 1.12.5, 1.13.1
Multicluster Engine for Kubernetes - update to 2.4.6
Red Hat Advanced Cluster Management for Kubernetes - addressed in versions 2.8.7, 2.9.5
PowerStore X - update to 3.2.1.4-2386214
Red Hat OpenShift Dev Spaces - addressed in versions 3.15.0, 3.16.0
PowerStore T - update to 4.0.0.2-2365061
Red Hat Advanced Cluster Security for Kubernetes - update to 4.5.0
IBM Cloud Pak for Watson AIOps - update to 4.7.0
Red Hat OpenShift Container Platform - addressed in versions 4.12.61, 4.13.45, 4.13.46, 4.14.32, 4.14.33, 4.14.34, 4.15.21, 4.16.15, 4.17.0
Storage Resource Manager - update to 5.0.1.0
Dell EMC Storage Monitoring and Reporting (SMR) - update to 5.0.1.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.0.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.0.1
OpenShift Logging - update to 5.6.21
Dell Secure Connect Gateway - update to 5.24.00.14
Red Hat Migration Toolkit for Applications - update to 6.2.3
Session Smart Router - addressed in versions 6.2.10, 6.3.7
IBM QRadar Network Packet Capture - update to 7.5.0 Update Package 10
IBM Power Hardware Management Console (HMC) - addressed in versions 10.2.1040.0 SP3, 10.3.1060.0 SP1
EMC Cloud Tiering Appliance - update to 13.2.0.2.29
less-debuginfo - addressed in versions 458-7.15.1, 530-150000.3.9.1, 590-150400.3.9.1, 643-150600.3.3.1
less - addressed in versions 458-7.15.1, 530-150000.3.9.1, 590-150400.3.9.1, 643-150600.3.3.1
less-debugsource - addressed in versions 458-7.15.1, 530-150000.3.9.1, 590-150400.3.9.1, 643-150600.3.3.1
less - addressed in versions 458-10, 530-3.0.1, 633-4
less (Red Hat package) - addressed in versions 458-10.el7_9, 530-2.el8_4, 530-3.el8_6, 590-2.el9_0, 590-3.el9_2, 590-4.el9_4
less-doc - addressed in versions 530-3.0.1, 633-4
less (Debian package) - addressed in versions 551-2+deb11u2, 590-2.1~deb12u2
less-debugsource - addressed in versions 590-4, 590-5, 590-6
less-debuginfo - addressed in versions 590-4, 590-5, 590-6
less - addressed in versions 590-4, 590-5, 590-6
less-help - addressed in versions 590-4, 590-5, 590-6
less - update to 608-2
less - addressed in versions 633-3.fc39, 643-5.fc40
less - update to 653

• https://www.openwall.com/lists/oss-security/2024/04/13/2
• https://www.openwall.com/lists/oss-security/2024/04/12/5
• https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33

• OS command injection in less
• Slackware Linux update for less
• openEuler update for less
• Ubuntu update for less
• SUSE update for less
• SUSE update for less
• openEuler 20.03 LTS SP4 update for less
• SUSE update for less
• openEuler 22.03 LTS SP1 update for less
• Red Hat Enterprise Linux 9 update for less
• Red Hat Enterprise Linux 7 update for less
• Multiple vulnerabilities in Dell Secure Connect Gateway
• SUSE update for less
• Multiple vulnerabilities in OpenShift API for Data Protection (OADP) 1.3
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications 6.2
• Multiple vulnerabilities in Dell Cloud Tiering Appliance
• Red Hat Enterprise Linux 8 update for less
• Red Hat Enterprise Linux 8 update for less
• Debian update for less
• Red Hat Enterprise Linux 9 update for less
• Red Hat Enterprise Linux 9 update for less
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.11
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in OpenShift Logging 5.6
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.5.0
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat build of Cryostat 3 on RHEL 8
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.13
• Multiple vulnerabilities in Dell Storage Resource Manager (SRM) and Dell Storage Monitoring and Reporting (SMR)
• Multiple vulnerabilities in Dell Data Protection Central
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in Red Hat OpenShift GitOps 1.12
• Fedora 39 update for less
• Fedora 40 update for less
• Amazon Linux AMI update for less
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.14
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.8
• OS command injection in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar SIEM
• Oracle Solaris update for thrid-party components
• Multiple vulnerabilities in Juniper Secure Analytics (JSA)
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Migration Toolkit for Containers 1.8
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Multiple vulnerabilities in IBM QRadar Network Packet Capture
• Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.4
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.9
• Multiple vulnerabilities in Dell PowerStore X
• IBM Power Hardware Management Console (HMC) update for less
• Multiple vulnerabilities in Dell PowerStore T Family
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Anolis OS update for less
• Anolis OS update for less
• Anolis OS update for less
• Dell SmartFabric Storage Software update for third-party components
• Meinberg LANTIME firmware update for third-party components (March 2025)
• Dell RecoverPoint for Virtual Machines update for third-party components
• Multiple vulnerabilities in IBM Voice Gateway
• Juniper Session Smart Router update for third-party components