Bug 1757324 (CVE-2019-14868) - CVE-2019-14868 ksh: certain environment variables interpreted as arithmetic expressions on startup, leading to code injection
Summary: CVE-2019-14868 ksh: certain environment variables interpreted as arithmetic e...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-14868
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1790542 1790543 1790544 1790545 1790546 1790547 1790549 1813403 1813404 1813405 1900646 1900647 1900648 1900649
Blocks: 1757327
TreeView+ depends on / blocked
 
Reported: 2019-10-01 08:45 UTC by Marian Rehak
Modified: 2023-03-24 15:33 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the way ksh evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables could allow them to exploit this issue remotely.
Clone Of:
Environment:
Last Closed: 2020-02-05 14:09:33 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:0431 0 None None None 2020-02-05 12:14:32 UTC
Red Hat Product Errata RHSA-2020:0515 0 None None None 2020-02-17 08:41:25 UTC
Red Hat Product Errata RHSA-2020:0559 0 None None None 2020-02-20 10:17:22 UTC
Red Hat Product Errata RHSA-2020:0568 0 None None None 2020-02-24 08:48:09 UTC
Red Hat Product Errata RHSA-2020:1332 0 None None None 2020-04-06 16:51:14 UTC
Red Hat Product Errata RHSA-2020:1333 0 None None None 2020-04-06 17:23:29 UTC
Red Hat Product Errata RHSA-2020:2210 0 None None None 2020-05-19 14:40:48 UTC
Red Hat Product Errata RHSA-2020:5351 0 None None None 2020-12-07 11:10:33 UTC
Red Hat Product Errata RHSA-2020:5352 0 None None None 2020-12-07 11:04:34 UTC

Description Marian Rehak 2019-10-01 08:45:01 UTC
Korn Shell is interpreting the contents of some environment variables on startup as an arithmetic expression and therefore potentially causing code injection vulnerabilities.

Comment 2 Stephane Chazelas 2019-10-07 10:06:40 UTC
(In reply to Marian Rehak from comment #1)
> Acknowledgments:
> 
> Name: Stephane Chazelas

Actually, most of the issues were found by Oliver Kiddle (zsh developer).

Comment 7 Riccardo Schirone 2019-10-31 10:10:35 UTC
During ksh startup, environment variables that are expected to contain a number are evaluated as an arithmetic expression. If an attacker is able to set specially crafted values in one of these environment variables before a ksh shell is executed (either directly or through a script), he could execute arbitrary commands before shell restrictions are in place.

In case of services and applications that use ksh scripts and allow remote users to provide one of the arithmetic environment variables, it could allow an attacker to exploit this issue.

Comment 18 Riccardo Schirone 2020-01-13 14:56:48 UTC
Upstream fix:
https://github.com/att/ast/commit/c7de8b641266bac7c77942239ac659edfee9ecd2

Comment 20 Riccardo Schirone 2020-01-13 15:25:15 UTC
Created ksh tracking bugs for this issue:

Affects: fedora-all [bug 1790549]

Comment 22 Riccardo Schirone 2020-01-13 16:16:28 UTC
Mitigation:

No known mitigation available.

Comment 23 errata-xmlrpc 2020-02-05 12:14:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:0431 https://access.redhat.com/errata/RHSA-2020:0431

Comment 24 Product Security DevOps Team 2020-02-05 14:09:33 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-14868

Comment 25 errata-xmlrpc 2020-02-17 08:41:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2020:0515 https://access.redhat.com/errata/RHSA-2020:0515

Comment 26 errata-xmlrpc 2020-02-20 10:17:13 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:0559 https://access.redhat.com/errata/RHSA-2020:0559

Comment 27 errata-xmlrpc 2020-02-24 08:48:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0568 https://access.redhat.com/errata/RHSA-2020:0568

Comment 30 errata-xmlrpc 2020-04-06 16:51:13 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.5 Extended Update Support

Via RHSA-2020:1332 https://access.redhat.com/errata/RHSA-2020:1332

Comment 31 errata-xmlrpc 2020-04-06 17:23:28 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.6 Extended Update Support

Via RHSA-2020:1333 https://access.redhat.com/errata/RHSA-2020:1333

Comment 32 errata-xmlrpc 2020-05-19 14:40:47 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2020:2210 https://access.redhat.com/errata/RHSA-2020:2210

Comment 34 errata-xmlrpc 2020-12-07 11:04:30 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.2 Advanced Update Support

Via RHSA-2020:5352 https://access.redhat.com/errata/RHSA-2020:5352

Comment 35 errata-xmlrpc 2020-12-07 11:10:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Advanced Update Support

Via RHSA-2020:5351 https://access.redhat.com/errata/RHSA-2020:5351


Note You need to log in before you can comment on or make changes to this bug.