CVE-1999-0491: Code Injection
The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove '.' and other user-writable directories from system and user PATHs. Ensure PATH entries are not writable by unprivileged users so attackers cannot create directories there with names matching commands.
shell (PATH) user-writable path entries = remove - Compensating control
Restrict filesystem write permissions and use ACLs on directories that are searched for executables (system bin directories and any shared directories) to prevent local users from creating directories named like commands.
- Operational
Audit filesystems for directories whose names match common commands that are owned or writable by unprivileged users; remove or quarantine any such directories and review logs for suspicious activity related to prompt parsing/command execution.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0491?
CVE-1999-0491 is considered to be a moderate severity vulnerability.
How do I fix CVE-1999-0491?
To fix CVE-1999-0491, users should upgrade to a patched version of GNU Bash beyond the affected versions.
Which software versions are affected by CVE-1999-0491?
CVE-1999-0491 affects GNU Bash versions 1.14.x and 2.05.
What type of attack does CVE-1999-0491 facilitate?
CVE-1999-0491 facilitates local users executing arbitrary commands as another user.
Can CVE-1999-0491 be exploited remotely?
CVE-1999-0491 is not directly exploitable remotely as it requires local user access.