CVE-2015-1418 - Vulnerability Details - OpenCVE

The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10.2-RC1-p2, and 0.2-RC2 before 10.2-RC2-p1, allows remote attackers to execute arbitrary commands via a crafted patch file, because a '!' character can be passed to the ed program.

No CVSS v4.0

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Freebsd	Freebsd

Configuration 1 [-]

OR	cpe:2.3:o:freebsd:freebsd:10.1:::::::*
	cpe:2.3:o:freebsd:freebsd:10.2:::::::*

No data.

References

Link	Providers
http://rachelbythebay.com/w/2018/04/05/bangpatch/
http://www.securityfocus.com/bid/76236
http://www.securitytracker.com/id/1033188
https://bugs.debian.org/894667
https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/013_patch.patch.sig
https://www.freebsd.org/security/advisories/FreeBSD-SA-15:18.bsdpatch.asc

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2018-02-05T16:00:00

Updated: 2024-08-06T04:40:18.692Z

Reserved: 2015-01-27T00:00:00

Link: CVE-2015-1418

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-02-05T16:29:00.300

Modified: 2024-11-21T02:25:22.850

Link: CVE-2015-1418

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2015-08-05T00:00:00", "descriptions": [{"lang": "en", "value": "The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10.2-RC1-p2, and 0.2-RC2 before 10.2-RC2-p1, allows remote attackers to execute arbitrary commands via a crafted patch file, because a '!' character can be passed to the ed program."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-04-06T04:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/013_patch.patch.sig"}, {"name": "76236", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/76236"}, {"name": "1033188", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1033188"}, {"name": "FreeBSD-SA-15:18", "tags": ["vendor-advisory", "x_refsource_FREEBSD"], "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-15:18.bsdpatch.asc"}, {"tags": ["x_refsource_MISC"], "url": "http://rachelbythebay.com/w/2018/04/05/bangpatch/"}, {"tags": ["x_refsource_MISC"], "url": "https://bugs.debian.org/894667"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2015-1418", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10.2-RC1-p2, and 0.2-RC2 before 10.2-RC2-p1, allows remote attackers to execute arbitrary commands via a crafted patch file, because a '!' character can be passed to the ed program."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/013_patch.patch.sig", "refsource": "MISC", "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/013_patch.patch.sig"}, {"name": "76236", "refsource": "BID", "url": "http://www.securityfocus.com/bid/76236"}, {"name": "1033188", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1033188"}, {"name": "FreeBSD-SA-15:18", "refsource": "FREEBSD", "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-15:18.bsdpatch.asc"}, {"name": "http://rachelbythebay.com/w/2018/04/05/bangpatch/", "refsource": "MISC", "url": "http://rachelbythebay.com/w/2018/04/05/bangpatch/"}, {"name": "https://bugs.debian.org/894667", "refsource": "MISC", "url": "https://bugs.debian.org/894667"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T04:40:18.692Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/013_patch.patch.sig"}, {"name": "76236", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/76236"}, {"name": "1033188", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1033188"}, {"name": "FreeBSD-SA-15:18", "tags": ["vendor-advisory", "x_refsource_FREEBSD", "x_transferred"], "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-15:18.bsdpatch.asc"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://rachelbythebay.com/w/2018/04/05/bangpatch/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugs.debian.org/894667"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2015-1418", "datePublished": "2018-02-05T16:00:00", "dateReserved": "2015-01-27T00:00:00", "dateUpdated": "2024-08-06T04:40:18.692Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:freebsd:freebsd:10.1:*:*:*:*:*:*:*", "matchCriteriaId": "F6D63B21-9D2E-4B15-9E60-6181D44B1F55", "vulnerable": true}, {"criteria": "cpe:2.3:o:freebsd:freebsd:10.2:*:*:*:*:*:*:*", "matchCriteriaId": "21EFF723-7B5A-4712-8A6B-56CADAA4BFD5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The do_ed_script function in pch.c in GNU patch through 2.7.6, and patch in FreeBSD 10.1 before 10.1-RELEASE-p17, 10.2 before 10.2-BETA2-p3, 10.2-RC1 before 10.2-RC1-p2, and 0.2-RC2 before 10.2-RC2-p1, allows remote attackers to execute arbitrary commands via a crafted patch file, because a '!' character can be passed to the ed program."}, {"lang": "es", "value": "La funci\u00f3n do_ed_script en pch.c en GNU patch hasta la versi\u00f3n 2.7.6; y patch in FreeBSD en versiones 10.1 anteriores a la 10.1-RELEASE-p17, versiones 10.2 anteriores a la 10.2-BETA2-p3, versiones 10.2-RC1 anteriores a la 10.2-RC1-p2 y versiones 0.2-RC2 anteriores a la 10.2-RC2-p1, permite que atacantes remotos ejecuten comandos arbitrarios mediante un archivo patch manipulado. Esto se debe a que se puede pasar un car\u00e1cter '!' al programa ed."}], "id": "CVE-2015-1418", "lastModified": "2024-11-21T02:25:22.850", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-02-05T16:29:00.300", "references": [{"source": "cve@mitre.org", "url": "http://rachelbythebay.com/w/2018/04/05/bangpatch/"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/76236"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1033188"}, {"source": "cve@mitre.org", "url": "https://bugs.debian.org/894667"}, {"source": "cve@mitre.org", "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/013_patch.patch.sig"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-15:18.bsdpatch.asc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rachelbythebay.com/w/2018/04/05/bangpatch/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/76236"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1033188"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugs.debian.org/894667"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/5.7/common/013_patch.patch.sig"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-15:18.bsdpatch.asc"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}