Is CVE-1999-1383 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-1383 being exploited in the wild.

How severe is CVE-1999-1383?

Medium severity, with a CVSS score of 4.6, published 13 September 1996.

Which products and versions are affected?

Gnu Bash before 1.14.7; Tcsh 6.05.

Is there a fix for CVE-1999-1383?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-1383 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-1999-1383?

Check whether you run Gnu Bash or Tcsh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-1383: GNU bash and tcsh command injection via directory names

CVE-1999-1383 · Severity: medium · CVSS 4.6 · Published 1996-09-13

A vulnerability in the Bash and tcsh command-line shells allows a local user to execute unauthorized commands. By creating a directory with a specially crafted name containing backticks, an attacker can trick another user into running malicious code when that user navigates into the directory. This could lead to the attacker gaining the privileges of the victim user, potentially compromising their files or the entire system.

Technologies: Gnu Bash. Vendors: Gnu.

Quick answers

Is CVE-1999-1383 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-1383 being exploited in the wild.
How severe is CVE-1999-1383?: Medium severity, with a CVSS score of 4.6, published 13 September 1996.
Which products and versions are affected?: Gnu Bash before 1.14.7; Tcsh 6.05.
Is there a fix for CVE-1999-1383?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-1383 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-1999-1383?: Check whether you run Gnu Bash or Tcsh at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in bash (before 1.14.7) and tcsh (6.05) due to improper handling of shell metacharacters in directory names. When the shell is configured to display the current working directory in the prompt (using the \w option in the PS1 environment variable), it may perform filename expansion on the directory name. A local attacker can create a directory containing backticks (`) with embedded commands. When an unsuspecting user or a privileged process changes into that directory, the shell expands the name and executes the enclosed commands with the privileges of the user who entered the directory. This can be used for local privilege escalation.

Affected products

GNU bash before 1.14.7
tcsh tcsh 6.05

Timeline

1996-09-13: disclosed: Initial disclosure on Bugtraq mailing list
1996-09-13: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.