CVE-2014-7817: Input Validation
Published Nov 24, 2014
·Updated
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDENOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((...))".
Affected Software
8 affected components
Canonical Ubuntu Linux=10.04
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=14.10
Debian Debian Linux=7.0
GNU glibc=2.21
openSUSE openSUSE=13.1
openSUSE openSUSE=13.2
Event History
Nov 24, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-7817?
CVE-2014-7817 is classified as a high severity vulnerability due to the potential for arbitrary command execution.
2
How do I fix CVE-2014-7817?
To fix CVE-2014-7817, upgrade the GNU C Library to a version later than 2.21 that enforces the WRDE_NOCMD flag.
3
What systems are affected by CVE-2014-7817?
CVE-2014-7817 affects specific versions of Ubuntu, Debian, and openSUSE that use glibc 2.21.
4
Can CVE-2014-7817 be exploited remotely?
CVE-2014-7817 can be exploited locally by attackers with access to a vulnerable system.
5
What type of attack is possible with CVE-2014-7817?
CVE-2014-7817 allows context-dependent attackers to execute arbitrary commands through manipulating input to the wordexp function.