CVE-2018-1000156

Published: Apr 6, 2018Modified: Apr 14, 2025

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. This attack appear to be exploitable via a patch file processed via the patch utility. This is similar to FreeBSD's CVE-2015-1418 however although they share a common ancestry the code bases have diverged over time.

Affected (29)

Products: Gnu: Patch · Canonical: Ubuntu Linux · Debian: Debian Linux · +1 more

Show all products

Gnu: Patch · Canonical: Ubuntu Linux · Debian: Debian Linux · Redhat: Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Server Tus, Enterprise Linux Workstation

1 product

1 product

1 product

6 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Server Tus

Enterprise Linux Workstation

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Patch	Version 2.7.6

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 17.10

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0

Configuration D

23 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 6.4
Redhat Enterprise Linux Server Aus	Version 6.5
Redhat Enterprise Linux Server Aus	Version 6.6
Redhat Enterprise Linux Server Aus	Version 7.2
Redhat Enterprise Linux Server Aus	Version 7.3
Redhat Enterprise Linux Server Aus	Version 7.4
Redhat Enterprise Linux Server Aus	Version 7.6
Redhat Enterprise Linux Server Eus	Version 6.7
Redhat Enterprise Linux Server Eus	Version 7.3
Redhat Enterprise Linux Server Eus	Version 7.4
Redhat Enterprise Linux Server Eus	Version 7.5
Redhat Enterprise Linux Server Eus	Version 7.6
Redhat Enterprise Linux Server Tus	Version 6.6
Redhat Enterprise Linux Server Tus	Version 7.2
Redhat Enterprise Linux Server Tus	Version 7.3
Redhat Enterprise Linux Server Tus	Version 7.4
Redhat Enterprise Linux Server Tus	Version 7.6
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (40)

http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html

Source: cve@mitre.org

http://rachelbythebay.com/w/2018/04/05/bangpatch/

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1199

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:1200

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2091

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2092

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2093

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2094

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2095

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2096

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2097

Source: cve@mitre.org

Third Party Advisory

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=894667#19

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://lists.debian.org/debian-lts-announce/2018/04/msg00013.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://savannah.gnu.org/bugs/index.php?53566

Source: cve@mitre.org

Vendor Advisory

https://seclists.org/bugtraq/2019/Aug/29

Source: cve@mitre.org

https://seclists.org/bugtraq/2019/Jul/54

Source: cve@mitre.org

https://security.gentoo.org/glsa/201904-17

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/3624-1/

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/3624-2/

Source: cve@mitre.org

Third Party Advisory

https://web.archive.org/web/20180405231329/https://twitter.com/kurtseifried/status/982028968877436928

Source: cve@mitre.org

http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html