CVE-2018-9862

util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain root access by leveraging the presence of an initial numeric value on an /etc/passwd line, and then issuing a "docker exec" command with that value in the -u argument, a similar issue to CVE-2016-3697.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securityfocus.com/bid/103738	Broken Link Third Party Advisory VDB Entry
https://github.com/hyperhq/hyperstart/pull/348	Patch Third Party Advisory
http://www.securityfocus.com/bid/103738	Broken Link Third Party Advisory VDB Entry
https://github.com/hyperhq/hyperstart/pull/348	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hyper:runv:1.0.0:*:*:*:*:docker:*:*

History

21 Nov 2024, 04:15

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/bid/103738 - Broken Link, Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/103738 - Broken Link, Third Party Advisory, VDB Entry
References	~~() https://github.com/hyperhq/hyperstart/pull/348 - Patch, Third Party Advisory~~	() https://github.com/hyperhq/hyperstart/pull/348 - Patch, Third Party Advisory

Information

Published : 2018-04-09 16:29

Updated : 2024-11-21 04:15

NVD link : CVE-2018-9862

Mitre link : CVE-2018-9862

CVE.ORG link : CVE-2018-9862

JSON object : View

Products Affected

hyper

runv

CWE

CWE-838

Inappropriate Encoding for Output Context

{"id": "CVE-2018-9862", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2018-04-09T16:29:00.273", "references": [{"url": "http://www.securityfocus.com/bid/103738", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://github.com/hyperhq/hyperstart/pull/348", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/103738", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/hyperhq/hyperstart/pull/348", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-838"}]}], "descriptions": [{"lang": "en", "value": "util.c in runV 1.0.0 for Docker mishandles a numeric username, which allows attackers to obtain root access by leveraging the presence of an initial numeric value on an /etc/passwd line, and then issuing a \"docker exec\" command with that value in the -u argument, a similar issue to CVE-2016-3697."}, {"lang": "es", "value": "util.c en runV 1.0.0 para Docker gestiona de manera incorrecta un usuario num\u00e9rico, lo que permite que los atacantes obtengan acceso root aprovechando la presencia de un valor num\u00e9rico inicial en una l\u00ednea /etc/passwd y, a continuaci\u00f3n, enviando un comando \"docker exec\" con ese valor en el argumento -u. Este problema es similar a CVE-2016-3697."}], "lastModified": "2024-11-21T04:15:49.883", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hyper:runv:1.0.0:*:*:*:*:docker:*:*", "vulnerable": true, "matchCriteriaId": "74D2932F-0D90-4506-8542-8879FA6BB90B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}