External Control of File Name or Path in beep
Summary
CVE-2018-1000532: beep version 1.3 and up contains a External Control of File Name or Path vulnerability in --device option that can result in Local unprivileged user can inhibit execution of arbitrary programs by other users, allowing Do... Affects beep versions < 1.4.3-1. Fixed in 1.4.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
beep is a command-line utility that allows users to generate system beeps. It is commonly used to provide audio feedback in shell scripts or command-line programs. The vulnerability in beep version 1.3 and up allows a local unprivileged user to inhibit the execution of arbitrary programs by other users, resulting in a denial of service (DoS) attack. This vulnerability can be exploited when the system allows local users to run beep.
Vulnerability Detail
The vulnerability in beep arises from the --device option, which is used to specify the audio device for generating the beep sound. By manipulating the file name or path provided as an argument to the --device option, a local unprivileged user can prevent the execution of arbitrary programs by other users. This can lead to a DoS attack, as certain programs may rely on audio feedback for proper functioning. The vulnerability has a CVSS score of 4.7, indicating a medium severity.
How To Fix
Minimum fixed version
1.4.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade beepTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The External Control of File Name or Path vulnerability in beep version 1.3 and up allows a local unprivileged user to inhibit the execution of arbitrary programs by other users, resulting in a denial of service (DoS) attack. To mitigate this vulnerability, users should update to beep version 1.4.3-1 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for beep →
FAQ
The vulnerability allows a local unprivileged user to inhibit the execution of arbitrary programs by other users, leading to a denial of service (DoS) attack.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, updating to beep version 1.4.3-1 or later will fix this vulnerability. Make sure to obtain the updated version from the official Debian repositories or the beep project's website.
No specific workarounds have been mentioned for this vulnerability.
The CVSS score of this vulnerability is 4.7, indicating a medium severity.
Related vulnerabilities
Recent vulnerabilities recorded for beep.
