← Back

CVE-1999-0491

nvd nist
Published: Apr 20, 1999Modified: Apr 16, 2026

JSON object

Loading...
4.6
Vector
AV:L/AC:L/Au:N/C:P/I:P/A:P
Exploitability: 3.9 / Impact: 6.4
Source: NVD

Description

The prompt parsing in bash allows a local user to execute commands as another user by creating a directory with the name of the command to execute.

Affected (17)

Products: Gnu: Bash
Gnu
1 product
Bash
Configuration A
17 vulnerable
Vulnerable SoftwareAffected Versions
Gnu
Bash
Up to 2.04
Bash
Version 1.14.0
Bash
Version 1.14.1
Bash
Version 1.14.2
Bash
Version 1.14.3
Bash
Version 1.14.4
Bash
Version 1.14.5
Bash
Version 1.14.6
Bash
Version 1.14.7
Bash
Version 2.01.1
Bash
Version 2.01
Bash
Version 2.02.1
Bash
Version 2.02
Bash
Version 2.03
Bash
Version 2.05
Bash
Version 2.05 a
Bash
Version 2.0

Related CWEs

CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (6)

ftp://ftp.calderasystems.com/pub/OpenLinux/security/CSSA-1999-008.0.txt (unsafe URL)
Source: cve@mitre.org
PatchVendor Advisory
Source: cve@mitre.org
Source: cve@mitre.org
ftp://ftp.calderasystems.com/pub/OpenLinux/security/CSSA-1999-008.0.txt (unsafe URL)
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.