Executive brief
A vulnerability in the Bash and tcsh command-line shells allows a local user to execute unauthorized commands. By creating a directory with a specially crafted name containing backticks, an attacker can trick another user into running malicious code when that user navigates into the directory. This could lead to the attacker gaining the privileges of the victim user, potentially compromising their files or the entire system.
Technical details
A command injection vulnerability exists in bash (before 1.14.7) and tcsh (6.05) due to improper handling of shell metacharacters in directory names. When the shell is configured to display the current working directory in the prompt (using the \w option in the PS1 environment variable), it may perform filename expansion on the directory name. A local attacker can create a directory containing backticks (`) with embedded commands. When an unsuspecting user or a privileged process changes into that directory, the shell expands the name and executes the enclosed commands with the privileges of the user who entered the directory. This can be used for local privilege escalation.
Affected products
- GNU bash before 1.14.7
- tcsh tcsh 6.05
Timeline
- 1996-09-13: disclosed: Initial disclosure on Bugtraq mailing list
- 1996-09-13: advisory: NVD publication date