Arbitrary Code Execution in GNU Guile 2.0.12
Summary
CVE-2016-8606: The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack. Affects guile versions < 2.0.11-r3. Fixed in 2.0.11-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GNU Guile is a programming language and an interpreter for Scheme. It provides a rich set of features for extending and embedding the language in other applications. The REPL server in GNU Guile 2.0.12 allows users to interact with the interpreter remotely. However, a vulnerability has been discovered in the REPL server that enables an attacker to execute arbitrary code through an HTTP inter-protocol attack.
Vulnerability Detail
The vulnerability, identified as CVE-2016-8606, allows an attacker to execute arbitrary code by exploiting the REPL server in GNU Guile 2.0.12. By sending specially crafted HTTP requests, an attacker can inject and execute arbitrary code on the target system. This can lead to unauthorized access, data theft, or further compromise of the affected system.
How To Fix
Minimum fixed version
2.0.11-r3
This is the first release that contains the fix.
sudo apk add --upgrade guileTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the GNU Guile package to the patched version.
Conclusion
The vulnerability in the REPL server of GNU Guile 2.0.12 allows for arbitrary code execution, which can lead to unauthorized access and data theft. It is crucial to update the GNU Guile package to the patched version to protect against this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for guile →
FAQ
GNU Guile is a programming language and an interpreter for Scheme. It provides a rich set of features for extending and embedding the language in other applications.
A REPL server allows users to interact with an interpreter remotely. It enables the execution of code and provides a way to evaluate expressions and commands in real-time.
If you are using GNU Guile 2.0.12 and have the REPL server (--listen) enabled, your system is vulnerable to arbitrary code execution. An attacker can exploit this vulnerability to execute malicious code on your system.
Yes, the vulnerability can be exploited remotely. An attacker can send specially crafted HTTP requests to the REPL server to execute arbitrary code on the target system.
Yes, a fix is available for this vulnerability. It is recommended to update the GNU Guile package to version 2.0.11-r3 or later to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for guile.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
