CVE-2010-0002: Input Validation

Published Jan 14, 2010

Updated

The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LSOPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename.

Affected Software

5 affected components

GNU Bash=2.05-b

GNU Bash=3.0

GNU Bash=3.2

GNU Bash=3.2.48

GNU Bash=4.0

Remediation

Patch Available

http://www.mandriva.com/security/advisories?name=MDVSA-2010:004

Event History

Jan 14, 2010

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-0002?

CVE-2010-0002 has a medium severity rating due to the potential for local users to exploit the vulnerability.

How do I fix CVE-2010-0002?

To fix CVE-2010-0002, update the GNU Bash package to the latest version available from your distribution.

What versions of Bash are affected by CVE-2010-0002?

CVE-2010-0002 affects Bash versions 2.05b, 3.0, 3.2, 3.2.48, and 4.0.

Can CVE-2010-0002 be exploited remotely?

CVE-2010-0002 cannot be exploited remotely; it requires local access to the system.

What impact does CVE-2010-0002 have on system security?

CVE-2010-0002 could allow local users to manipulate terminal output and potentially hide files, impacting system integrity.