CVE-2022-4515

A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.debian.org/debian-lts-announce/2022/12/msg00040.html	Mailing List Third Party Advisory
https://sourceforge.net/p/ctags/code/HEAD/tree/tags/ctags-5.8/sort.c#l56	Exploit Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/12/msg00040.html	Mailing List Third Party Advisory
https://sourceforge.net/p/ctags/code/HEAD/tree/tags/ctags-5.8/sort.c#l56	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:exuberant_ctags_project:exuberant_ctags:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

History

21 Nov 2024, 07:35

Type	Values Removed	Values Added
References	~~() https://lists.debian.org/debian-lts-announce/2022/12/msg00040.html - Mailing List, Third Party Advisory~~	() https://lists.debian.org/debian-lts-announce/2022/12/msg00040.html - Mailing List, Third Party Advisory
References	~~() https://sourceforge.net/p/ctags/code/HEAD/tree/tags/ctags-5.8/sort.c#l56 - Exploit, Third Party Advisory~~	() https://sourceforge.net/p/ctags/code/HEAD/tree/tags/ctags-5.8/sort.c#l56 - Exploit, Third Party Advisory

Information

Published : 2022-12-20 19:15

Updated : 2024-11-21 07:35

NVD link : CVE-2022-4515

Mitre link : CVE-2022-4515

CVE.ORG link : CVE-2022-4515

JSON object : View

Products Affected

exuberant_ctags_project

exuberant_ctags

debian

debian_linux

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

NVD-CWE-noinfo

{"id": "CVE-2022-4515", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-12-20T19:15:25.190", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00040.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://sourceforge.net/p/ctags/code/HEAD/tree/tags/ctags-5.8/sort.c#l56", "tags": ["Exploit", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00040.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://sourceforge.net/p/ctags/code/HEAD/tree/tags/ctags-5.8/sort.c#l56", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-78"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Exuberant Ctags in the way it handles the \"-o\" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en Exuberant Ctags en la forma en que maneja la opci\u00f3n \"-o\". Esta opci\u00f3n especifica el nombre del archivo de etiqueta. Un nombre de archivo de etiqueta modificado especificado en la l\u00ednea de comando o en el archivo de configuraci\u00f3n da como resultado la ejecuci\u00f3n de un comando arbitrario porque externalSortTags() en sort.c llama a la funci\u00f3n system(3) de manera insegura."}], "lastModified": "2024-11-21T07:35:25.033", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:exuberant_ctags_project:exuberant_ctags:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5341B744-3F8E-4AB4-991C-0DDEB973EEED"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}