CVE-2015-1815: Command Injection
It was found that setroubleshoot did not sanitize file names supplied in a shell command look-up for RPMs associated with access violation reports. An attacker could use this flaw to escalate their privileges on the system by supplying a specially crafted file to the underlying shell command.
The vulnerable code in util.py:
266 def getrpmnvrbyfilepathtemporary(name): 267 if name is None or not os.path.exists(name): 268 return None 269 270 nvr = None 271 try: 272 import commands 273 rc, output = commands.getstatusoutput("rpm -qf '%s'" % name) 274 if rc == 0: 275 nvr = output 276 except: 277 syslog.syslog(syslog.LOGERR, "failed to retrieve rpm info for %s" % name) 278 return nvr
Acknowledgements:
Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for reporting this issue.
Other sources
The getrpmnvrbyfilepathtemporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1815?
CVE-2015-1815 has a medium severity rating due to the potential for privilege escalation.
How do I fix CVE-2015-1815?
To fix CVE-2015-1815, update the affected SELinux Setroubleshoot package to version 3.2.22 or later.
Which software is affected by CVE-2015-1815?
CVE-2015-1815 affects SELinux Setroubleshoot up to version 3.2.21 and Fedora version 22.
Can CVE-2015-1815 be exploited remotely?
CVE-2015-1815 typically requires local access to the system to be exploited.
What is the impact of CVE-2015-1815 on system security?
The impact of CVE-2015-1815 allows an attacker to escalate privileges, potentially leading to unauthorized access to system resources.