CVE-2017-1000083 Command injection in n/a
Remote attackers can execute arbitrary commands by tricking users into opening a malicious .cbt file in Evince.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-1000083?
CVE-2017-1000083 is a high-severity command injection vulnerability in Debian Debian Linux, published on 5 Sep 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
Which versions are affected by CVE-2017-1000083?
It affects 8 products.
Linux distribution packages (40)
evince Red Hat:enterprise_linux:7::client | All versions | 0:3.22.1-5.2.el7_4 |
evince-browser-plugin Red Hat:enterprise_linux:7::client | All versions | 0:3.22.1-5.2.el7_4 |
evince-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:3.22.1-5.2.el7_4 |
evince-devel Red Hat:enterprise_linux:7::client | All versions | 0:3.22.1-5.2.el7_4 |
evince-dvi Red Hat:enterprise_linux:7::client | All versions | 0:3.22.1-5.2.el7_4 |
evince-libs Red Hat:enterprise_linux:7::client | All versions | 0:3.22.1-5.2.el7_4 |
evince-nautilus Red Hat:enterprise_linux:7::client | All versions | 0:3.22.1-5.2.el7_4 |
evince Red Hat:enterprise_linux:7::server | All versions | 0:3.22.1-5.2.el7_4 |
evince-browser-plugin Red Hat:enterprise_linux:7::server | All versions | 0:3.22.1-5.2.el7_4 |
evince-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:3.22.1-5.2.el7_4 |
evince-devel Red Hat:enterprise_linux:7::server | All versions | 0:3.22.1-5.2.el7_4 |
evince-dvi Red Hat:enterprise_linux:7::server | All versions | 0:3.22.1-5.2.el7_4 |
evince-libs Red Hat:enterprise_linux:7::server | All versions | 0:3.22.1-5.2.el7_4 |
evince-nautilus Red Hat:enterprise_linux:7::server | All versions | 0:3.22.1-5.2.el7_4 |
evince Red Hat:enterprise_linux:7::workstation | All versions | 0:3.22.1-5.2.el7_4 |
evince-browser-plugin Red Hat:enterprise_linux:7::workstation | All versions | 0:3.22.1-5.2.el7_4 |
evince-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:3.22.1-5.2.el7_4 |
evince-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:3.22.1-5.2.el7_4 |
evince-dvi Red Hat:enterprise_linux:7::workstation | All versions | 0:3.22.1-5.2.el7_4 |
evince-libs Red Hat:enterprise_linux:7::workstation | All versions | 0:3.22.1-5.2.el7_4 |
evince-nautilus Red Hat:enterprise_linux:7::workstation | All versions | 0:3.22.1-5.2.el7_4 |
evince SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 3.20.1-6.14.1 |
evince SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 3.20.1-6.16.1 |
evince SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 3.20.2-6.19.15 |
evince SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 3.20.1-6.16.1 |
evince SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 3.20.2-6.19.15 |
evince SUSE:Linux Enterprise Server 12 SP1-LTSS | All versions | 3.10.3-2.3.1 |
evince SUSE:Linux Enterprise Server 12 SP2 | All versions | 3.20.1-6.14.1 |
evince SUSE:Linux Enterprise Server 12 SP2 | All versions | 3.20.1-6.16.1 |
evince SUSE:Linux Enterprise Server 12 SP2 | All versions | 3.20.2-6.19.15 |
evince SUSE:Linux Enterprise Server 12 SP3 | All versions | 3.20.1-6.16.1 |
evince SUSE:Linux Enterprise Server 12 SP3 | All versions | 3.20.2-6.19.15 |
evince SUSE:Linux Enterprise Server 12-LTSS | All versions | 3.10.3-2.3.1 |
evince SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 3.20.1-6.14.1 |
evince SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 3.20.1-6.16.1 |
evince SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 3.20.2-6.19.15 |
evince SUSE:Linux Enterprise Server for SAP Applications 12 | All versions | 3.10.3-2.3.1 |
evince SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 3.10.3-2.3.1 |
evince SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 3.20.1-6.14.1 |
evince SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 3.20.1-6.16.1 |
Products include Debian Debian Linux, Gnome Evince, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Eus and 2 more.
How do I fix CVE-2017-1000083?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-1000083 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-1000083 exists.
Public exploit code: 1 Metasploit module, 3 Exploit-DB entries and 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2024-SE84870, DEBIAN-CVE-2017-1000083, DLA-1031-1, DSA-3911-1, DSA-3916-1, GHSA-c796-cmwx-5c79 and 9 more.