CVE-2016-6656 Command injection in Pivotal Greenplum 4.3.0.0 to 4.3.9.1 and older versions that are end of life
Privileged users can inject arbitrary commands via GPHDFS external tables, leading to code execution on the database server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-6656?
CVE-2016-6656 is a high-severity command injection vulnerability in Pivotal Greenplum 4.3.0.0 to 4.3.9.1 and older versions that are end of life, published on 16 Dec 2016. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in Pivotal Greenplum before 4.3.10.0. Creation of external tables using GPHDFS protocol has a vulnerability whereby arbitrary commands can be injected into the system. In order to exploit this vulnerability the user must have superuser 'gpadmin' access to the system or have been granted GPHDFS protocol permissions in order to create a GPHDFS external table.
Weakness: CWE-77
Which versions are affected by CVE-2016-6656?
It affects 1 product.
Products include Pivotal Software Greenplum.
How do I fix CVE-2016-6656?
No fix has been published for CVE-2016-6656 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-6656 being exploited?
There is no known exploitation of CVE-2016-6656 in the wild and no public exploit code.
Sources
Also known as GHSA-xf4j-p5gp-h24h.