NetSight
IP …
medium4.6

CVE-2014-7817

The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary comm…

Impact

The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".

Affected products

VendorProductAffected versions
CanonicalUbuntu Linux
Versions 10.04, 12.04, 14.04, 14.10
DebianDebian Linux
Version 7.0
GnuGlibc
Version 2.21
OpensuseOpensuse
Versions 13.1, 13.2

Weakness classification

CWE-20

References