CVE-2003-1538 Command injection in n/a
Remote attackers can execute arbitrary commands via CGI queries due to improper filtering of shell metacharacters in SuSE Linux susehelp.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2003-1538?
CVE-2003-1538 is a medium-severity command injection vulnerability in Suse Suse Linux, published on 20 Dec 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
susehelp in SuSE Linux 8.1, Enterprise Server 8, Office Server, and Openexchange Server 4 does not properly filter shell metacharacters, which allows remote attackers to execute arbitrary commands via CGI queries.
Weakness: CWE-20
Which versions are affected by CVE-2003-1538?
It affects 3 products.
Products include Suse Office Server, Suse Suse Linux, Suse Suse Linux Openexchange Server.
How do I fix CVE-2003-1538?
No fix has been published for CVE-2003-1538 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2003-1538 being exploited?
There is no known exploitation of CVE-2003-1538 in the wild and no public exploit code.
Sources
Also known as GHSA-chm7-w788-3xfh.