High severity · published Aug 28, 2017
CVE-2016-0634
The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine
7.5
CVSS
6%
EPSS
No
On KEV
Description
The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.0% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Bash · Gnu
4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-0634
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-0634
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2017-0725.html
Mailing List
http://www.openwall.com/lists/oss-security/2016/09/16/12
Mailing List
http://www.openwall.com/lists/oss-security/2016/09/16/8
Mailing List
http://www.openwall.com/lists/oss-security/2016/09/18/11
Mailing List
http://www.openwall.com/lists/oss-security/2016/09/19/7
Mailing List
http://www.openwall.com/lists/oss-security/2016/09/20/1
More from Bash
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
8.8
CVE-2014-6278
GNU Bash OS Command Injection Vulnerability
8.4
CVE-2016-7543
Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables
7.8
CVE-2022-3715
A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform