CVE-2017-9462 Mercurial has Incorrect Permission Assignment for Critical Resource
Authenticated attackers can execute arbitrary code by passing --debugger as a repository name to hg serve --stdio.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-9462?
CVE-2017-9462 is a high-severity code injection vulnerability in Debian Debian Linux, published on 6 Jun 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.
Weakness: CWE-732
Which versions are affected by CVE-2017-9462?
3 open source packages ship an affected version, including mercurial. It affects 8 products.
| Package | Affected | Fixed in |
|---|---|---|
mercurial PyPI | All versions | 4.1.3 |
mercurial PyPI | All versions | 4.1.3 |
mercurial PyPI | All versions | 4.1.3 |
Linux distribution packages (37)
emacs-mercurial Red Hat:enterprise_linux:6::client | All versions | 0:1.4-5.el6_9 |
emacs-mercurial-el Red Hat:enterprise_linux:6::client | All versions | 0:1.4-5.el6_9 |
mercurial Red Hat:enterprise_linux:6::client | All versions | 0:1.4-5.el6_9 |
mercurial-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:1.4-5.el6_9 |
mercurial-hgk Red Hat:enterprise_linux:6::client | All versions | 0:1.4-5.el6_9 |
emacs-mercurial Red Hat:enterprise_linux:6::computenode | All versions | 0:1.4-5.el6_9 |
emacs-mercurial-el Red Hat:enterprise_linux:6::computenode | All versions | 0:1.4-5.el6_9 |
mercurial Red Hat:enterprise_linux:6::computenode | All versions | 0:1.4-5.el6_9 |
mercurial-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:1.4-5.el6_9 |
mercurial-hgk Red Hat:enterprise_linux:6::computenode | All versions | 0:1.4-5.el6_9 |
emacs-mercurial Red Hat:enterprise_linux:6::server | All versions | 0:1.4-5.el6_9 |
emacs-mercurial-el Red Hat:enterprise_linux:6::server | All versions | 0:1.4-5.el6_9 |
mercurial Red Hat:enterprise_linux:6::server | All versions | 0:1.4-5.el6_9 |
mercurial-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:1.4-5.el6_9 |
mercurial-hgk Red Hat:enterprise_linux:6::server | All versions | 0:1.4-5.el6_9 |
emacs-mercurial Red Hat:enterprise_linux:6::workstation | All versions | 0:1.4-5.el6_9 |
emacs-mercurial-el Red Hat:enterprise_linux:6::workstation | All versions | 0:1.4-5.el6_9 |
mercurial Red Hat:enterprise_linux:6::workstation | All versions | 0:1.4-5.el6_9 |
mercurial-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 0:1.4-5.el6_9 |
mercurial-hgk Red Hat:enterprise_linux:6::workstation | All versions | 0:1.4-5.el6_9 |
emacs-mercurial Red Hat:enterprise_linux:7::client | All versions | 0:2.6.2-7.el7_3 |
emacs-mercurial-el Red Hat:enterprise_linux:7::client | All versions | 0:2.6.2-7.el7_3 |
mercurial Red Hat:enterprise_linux:7::client | All versions | 0:2.6.2-7.el7_3 |
mercurial-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:2.6.2-7.el7_3 |
mercurial-hgk Red Hat:enterprise_linux:7::client | All versions | 0:2.6.2-7.el7_3 |
emacs-mercurial Red Hat:enterprise_linux:7::computenode | All versions | 0:2.6.2-7.el7_3 |
emacs-mercurial-el Red Hat:enterprise_linux:7::computenode | All versions | 0:2.6.2-7.el7_3 |
mercurial Red Hat:enterprise_linux:7::computenode | All versions | 0:2.6.2-7.el7_3 |
mercurial-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:2.6.2-7.el7_3 |
mercurial-hgk Red Hat:enterprise_linux:7::computenode | All versions | 0:2.6.2-7.el7_3 |
emacs-mercurial Red Hat:enterprise_linux:7::server | All versions | 0:2.6.2-7.el7_3 |
emacs-mercurial-el Red Hat:enterprise_linux:7::server | All versions | 0:2.6.2-7.el7_3 |
mercurial Red Hat:enterprise_linux:7::server | All versions | 0:2.6.2-7.el7_3 |
mercurial-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:2.6.2-7.el7_3 |
mercurial-hgk Red Hat:enterprise_linux:7::server | All versions | 0:2.6.2-7.el7_3 |
emacs-mercurial Red Hat:enterprise_linux:7::workstation | All versions | 0:2.6.2-7.el7_3 |
emacs-mercurial-el Red Hat:enterprise_linux:7::workstation | All versions | 0:2.6.2-7.el7_3 |
Products include Debian Debian Linux, Mercurial Mercurial, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus, Redhat Enterprise Linux Server Eus and 2 more.
How do I fix CVE-2017-9462?
Upgrade mercurial to 4.1.3 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-9462 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-9462 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2017-9462, DLA-1005-1, GHSA-ghjx-3jg5-h6r2, MGASA-2017-0182, PYSEC-2017-91, RHSA-2017:1576 and 3 more.