SUSE update for ksh
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2019-14868 |
| CWE-ID | CWE-78 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
Legacy Module Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 12 Operating systems & Components / Operating system SUSE Linux Enterprise Server 12 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 12 Operating systems & Components / Operating system SUSE Linux Enterprise Software Development Kit 12 Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system ksh-devel Operating systems & Components / Operating system package or component ksh Operating systems & Components / Operating system package or component ksh-debugsource Operating systems & Components / Operating system package or component ksh-debuginfo Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) OS Command Injection
EUVDB-ID: #VU25547
Risk: Low
CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-14868
CWE-ID:
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Exploit availability: No
DescriptionThe vulnerability allows a local user to execute arbitrary shell commands on the target system.
The vulnerability exists in the way ksh evaluates certain environment variables . A local user can set a specially crafted environment variable and execute arbitrary OS commands on the target system.
MitigationUpdate the affected package ksh to the latest version.
Vulnerable software versionsLegacy Module: 12
SUSE Linux Enterprise Server for SAP Applications 12: SP1 - SP5
SUSE Linux Enterprise Server 12: SP1 - SP5
SUSE Linux Enterprise High Performance Computing 12: SP2 - SP5
SUSE Linux Enterprise Software Development Kit 12: SP5
SUSE Linux Enterprise Server for SAP Applications: 12-SP4
SUSE Linux Enterprise Server: 12-SP2-LTSS-ERICSSON
ksh-devel: before 93vu-19.3.2
ksh: before 93vu-19.3.2
ksh-debugsource: before 93vu-19.3.2
ksh-debuginfo: before 93vu-19.3.2
CPE2.3- cpe:2.3:o:suse:legacy_module:12:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP1:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP2:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_12:SP3:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP1:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP2:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_12:SP3:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP2:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP3:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_12:SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_software_development_kit_12:SP5:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:12-SP4:*:*:*:*:*:*:
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP2-LTSS-ERICSSON:*:*:*:*:*:*:
- cpe:2.3:o:suse:ksh-devel:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:ksh:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:ksh-debugsource:*:*:*:*:*:suse_linux:*:
- cpe:2.3:o:suse:ksh-debuginfo:*:*:*:*:*:suse_linux:*:
http://www.suse.com/support/update/announcement/2024/suse-su-20242756-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
