CVE-2014-8990

Опубликовано: 05 дек. 2014

Источник: nvd

CVSS2: 7.5

EPSS Низкий

Описание

default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.

Ссылки

http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145114.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145131.html
Third Party Advisory
http://secunia.com/advisories/62321
http://www.debian.org/security/2015/dsa-3130
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/11/19/1
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/11/20/5
Exploit
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/71179
Third Party Advisory
VDB Entry
https://github.com/axkibe/lsyncd/commit/18f02ad013b41a72753912155ae2ba72f2a53e52
Exploit
Issue Tracking
Patch
https://github.com/axkibe/lsyncd/commit/e6016b3748370878778b8f0b568d5281cc248aa4
Exploit
Issue Tracking
Patch
https://github.com/axkibe/lsyncd/issues/220
Issue Tracking
Patch
https://security.gentoo.org/glsa/201702-05
http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145114.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145131.html
Third Party Advisory
http://secunia.com/advisories/62321
http://www.debian.org/security/2015/dsa-3130
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/11/19/1
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/11/20/5
Exploit
Mailing List
Third Party Advisory
http://www.securityfocus.com/bid/71179
Third Party Advisory
VDB Entry
https://github.com/axkibe/lsyncd/commit/18f02ad013b41a72753912155ae2ba72f2a53e52
Exploit
Issue Tracking
Patch
https://github.com/axkibe/lsyncd/commit/e6016b3748370878778b8f0b568d5281cc248aa4
Exploit
Issue Tracking
Patch

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:a:lsyncd_project:lsyncd:*:*:*:*:*:*:*:*

Версия до 2.1.5 (включая)

EPSS

Процентиль: 92%

0.05236

Низкий

7.5 High

CVSS2

Дефекты

CWE-77

Связанные уязвимости

CVE-2014-8990

ubuntu

больше 11 лет назад

default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.

CVE-2014-8990

debian

больше 11 лет назад

default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attacke ...

GHSA-2jg7-cr9w-6gw3

github

около 4 лет назад

default-rsyncssh.lua in Lsyncd 2.1.5 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.

EPSS

Процентиль: 92%

0.05236

Низкий

7.5 High

CVSS2

Дефекты

CWE-77