24 lines
747 B
YAML
24 lines
747 B
YAML
cve: CVE-2018-1000156
|
|
alias: GNU patch ed-mode arbitrary command exec
|
|
cwe_primary: CWE-78
|
|
cwe_acceptable: [CWE-78, CWE-77, CWE-88, CWE-74]
|
|
target_file: source.c
|
|
vuln_lines: [29, 30]
|
|
severity: high
|
|
vuln_class: command_injection
|
|
exploit_pattern_regex: '`|\$\(|;|&&|\|\|'
|
|
must_mention_any:
|
|
- system()
|
|
- shell metacharacter
|
|
- command injection
|
|
- snprintf
|
|
- unsanitised
|
|
- unsanitized
|
|
- shell command
|
|
points: 25
|
|
notes: |
|
|
Vulnerability: target_path_from_patch_header returns an unvalidated string
|
|
copied from the patch header. apply_ed_patch then formats it directly into a
|
|
shell command with snprintf and passes to system(). Attacker controls the
|
|
patch file → controls `target` → injects backticks/$()/; → arbitrary command.
|