CVE-2016-7787 Command injection in n/a
Attackers can hide malicious commands in kdesu prompts, tricking users into executing arbitrary code with root privileges.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7787?
CVE-2016-7787 is a medium-severity command injection vulnerability in Opensuse Leap, published on 23 Dec 2016. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user.
Weakness: CWE-94
Which versions are affected by CVE-2016-7787?
It affects 3 products.
Linux distribution packages (2)
kde-cli-tools5 SUSE:Package Hub 12 SP1 | All versions | 5.5.5-12.1 |
kde-cli-tools5 SUSE:Package Hub 12 SP1 | All versions | 5.5.5-12.1 |
Products include Kde Kde-Cli-Tools, Opensuse Leap, Opensuse Opensuse.
How do I fix CVE-2016-7787?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-7787 being exploited?
There is no known exploitation of CVE-2016-7787 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2016-7787, GHSA-2rvv-92pm-m5p9, MGASA-2017-0473, UBUNTU-CVE-2016-7787, openSUSE-SU-2016:2495-1, openSUSE-SU-2016:2498-1.