ALSA-2024:4256 - Important: less security update
Summary
ALSA-2024:4256: Important: less security update. Affects less versions < 530-3.el8_10. Fixed in 530-3.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The "less" utility is a text file browser that resembles "more", but allows users to move backwards in the file as well as forwards. It is designed to read and display text files in a terminal. Unlike traditional text editors, "less" does not load the entire file into memory at startup, making it faster for large files. The utility is commonly used for viewing log files, reading documentation, and navigating through long texts.
The vulnerability affects the "less" utility in AlmaLinux 8. It is important to keep this utility updated to ensure the security of the system.
Vulnerability Detail
The vulnerability in the "less" utility includes two security issues:
-
OS command injection (CVE-2024-32487): This vulnerability allows an attacker to execute arbitrary commands on the system by injecting malicious commands through specially crafted input files. If a user opens a malicious file with the "less" utility, the injected commands can be executed with the privileges of the user running "less".
-
Missing quoting of shell metacharacters in LESSCLOSE handling (CVE-2022-48624): This vulnerability allows an attacker to execute arbitrary commands during the handling of the LESSCLOSE environment variable. By manipulating the variable, an attacker can execute commands with the privileges of the user running "less".
These vulnerabilities can lead to unauthorized command execution and potential compromise of the system.
How To Fix
Minimum fixed version
530-3.el8_10
This is the first release that contains the fix.
sudo dnf update lessTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The "less" utility in AlmaLinux 8 is vulnerable to OS command injection and shell metacharacter quoting issues. These vulnerabilities can allow an attacker to execute arbitrary commands on the system. It is crucial to update the "less" package to the fixed version to mitigate the risk of unauthorized access and potential compromise of the system.
See every vulnerability recorded for less →
FAQ
These vulnerabilities can allow an attacker to execute arbitrary commands on the system, potentially leading to unauthorized access, data loss, or further compromise of the system.
No, only versions prior to 530-3.el8_10 in AlmaLinux 8 are affected. Updating to the fixed version will resolve the vulnerabilities.
At the time of this advisory, there are no known public exploits for these vulnerabilities. However, it is important to apply the security update as soon as possible to mitigate the risk.
No, these vulnerabilities require a user to open a specially crafted file using the "less" utility. Remote exploitation is not possible without user interaction.
Yes, there are alternative text file browsers available, such as "more" and "cat". However, it is recommended to update the "less" utility to the fixed version to ensure the security of the system.
Related vulnerabilities
Recent vulnerabilities recorded for less.
