CVE-2016-0634

Published on: 08/28/2017 12:00:00 AM UTC

Last Modified on: 03/23/2021 11:27:13 PM UTC

CVE-2016-0634

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Certain versions of Bash from Gnu contain the following vulnerability:

The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.

CVE-2016-0634 has been assigned by [email protected] to track the vulnerability - currently rated as HIGH severity.

CVSS3 Score: 7.5 - HIGH

Attack Vector ^ⓘ	Attack Complexity	Privileges Required	User Interaction
NETWORK	HIGH	LOW	NONE
Scope	Confidentiality Impact	Integrity Impact	Availability Impact
UNCHANGED	HIGH	HIGH	HIGH

CVSS2 Score: 6 - MEDIUM

Access Vector^ⓘ	Access Complexity	Authentication
NETWORK	MEDIUM	SINGLE
Confidentiality Impact	Integrity Impact	Availability Impact
PARTIAL	PARTIAL	PARTIAL

CVE References

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

There are currently no QIDs associated with this CVE

Known Affected Configurations (CPE V2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Gnu	Bash	4.3	All	All	All
Application	Gnu	Bash	4.3	All	All	All

cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:*:
cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:*:

No vendor comments have been submitted for this CVE

Description	Tags ^ⓘ	Link
oss-security - RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME	Mailing List Third Party Advisory www.openwall.com text/html	MLIST [oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME
Red Hat Customer Portal	access.redhat.com text/html	REDHAT RHSA-2017:1931
oss-security - Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME	Mailing List Third Party Advisory www.openwall.com text/html	MLIST [oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME
oss-security - Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME	Mailing List Third Party Advisory www.openwall.com text/html	MLIST [oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME
Red Hat Customer Portal	web.archive.org text/html Inactive LinkNot Archived	REDHAT RHSA-2017:0725
oss-security - Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME	Mailing List Third Party Advisory www.openwall.com text/html	MLIST [oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME
GNU Bash CVE-2016-0634 Local Code Execution Vulnerability	Third Party Advisory VDB Entry cve.report (archive) text/html	BID 92999
oss-security - Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME	Mailing List Third Party Advisory www.openwall.com text/html	MLIST [oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME
Bash: Arbitrary code execution (GLSA 201612-39) — Gentoo security	Third Party Advisory security.gentoo.org text/html	GENTOO GLSA-201612-39
Bug 1377613 – CVE-2016-0634 bash: Arbitrary code execution via malicious hostname	Issue Tracking Patch Third Party Advisory VDB Entry bugzilla.redhat.com text/html	CONFIRM bugzilla.redhat.com/show_bug.cgi?id=1377613
oss-security - Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME	Mailing List Third Party Advisory www.openwall.com text/html	MLIST [oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME
oss-security - Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME	Mailing List Third Party Advisory www.openwall.com text/html	MLIST [oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME
oss-security - Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME	Mailing List Third Party Advisory www.openwall.com text/html	MLIST [oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME
oss-security - Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME	Mailing List Third Party Advisory www.openwall.com text/html	MLIST [oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME
oss-security - CVE-2016-0634 -- bash prompt expanding $HOSTNAME	Mailing List Patch Third Party Advisory www.openwall.com text/html	MLIST [oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME