#VU11178 Command injection in Thrift - CVE-2016-5397

Vulnerability identifier: #VU11178

Vulnerability risk: High

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Amber]

CVE-ID: CVE-2016-5397

CWE-ID: CWE-77

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Thrift
Server applications / Frameworks for developing and running applications

Vendor: Apache Foundation

Description
The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.

The weakness exists in the ft_go_generator.cc:format_go_output()function due to command injection. A remote attacker can submit a specially crafted service name through an external formatting tool and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation
Update to version 0.10.0.

Vulnerable software versions

Thrift: 0.9.0 - 0.9.3

---

External links
https://issues.apache.org/jira/browse/THRIFT-3893

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.