CVE-2016-4444: Command Injection
It was reported that execmod and execstack setroubleshoot plugins use commands.getstatusoutput("... %s ...") which can be misused in such a way when appropriate setroubleshoot plugin analyzes the AVC triggered by binary, setroubleshoot daemon executes arbitrary commands which are part of the binary filename.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1332411
Other sources
The allowexecmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a crafted binary filename, related to the commands.getstatusoutput function.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4444?
CVE-2016-4444 is considered a high-severity vulnerability due to its potential to allow local users to execute arbitrary commands.
How do I fix CVE-2016-4444?
To fix CVE-2016-4444, you should upgrade to setroubleshoot-plugins version 3.2.23 or later.
Who is affected by CVE-2016-4444?
CVE-2016-4444 affects users running setroubleshoot-plugins versions earlier than 3.2.23 on systems like Red Hat Enterprise Linux 7.0.
What causes CVE-2016-4444?
CVE-2016-4444 is caused by inadequate handling of execmod SELinux denials, allowing crafted binary filenames to execute arbitrary commands.
Is CVE-2016-4444 a local or remote vulnerability?
CVE-2016-4444 is a local vulnerability, allowing exploitation only by authenticated users with local access.