CVE-2016-4989 Command injection in n/a
Local attackers can bypass container protections and execute arbitrary commands via crafted file names or XML inputs in setroubleshoot.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-4989?
CVE-2016-4989 is a high-severity command injection vulnerability in Redhat Enterprise Linux Desktop, published on 11 Apr 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with a crafted file name, which is handled by the _set_tpath function in audit_data.py or via a crafted (2) local_id or (3) analysis_id field in a crafted XML document to the run_fix function in SetroubleshootFixit.py, related to the subprocess.check_output and commands.getstatusoutput functions, a different vulnerability than CVE-2016-4445.
Weakness: CWE-77
Which versions are affected by CVE-2016-4989?
It affects 5 products.
Products include Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Hpc Node, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation, Setroubleshoot Project Setroubleshoot.
How do I fix CVE-2016-4989?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-4989 being exploited?
There is no known exploitation of CVE-2016-4989 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux Desktop
Sources
Also known as GHSA-585r-x79p-835g.