Privilege Escalation Vulnerability in mksh Package
Summary
DEBIAN-CVE-2008-1845: The Korn shell (aka mksh) before R33d on MirOS (aka MirBSD) does not flush the tty's I/O when invoking mksh in a new terminal, which allows local users to gain privileges by opening a virtual terminal and entering comman... Affects mksh versions < 33.4-1. Fixed in 33.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The mksh (MirBSD Korn Shell) is a command-line shell that is widely used in Unix-like operating systems. It provides a user interface for executing commands, scripting, and managing system processes. The mksh package is known for its compatibility with the Korn shell and offers features such as command-line editing, job control, and scripting capabilities. However, it has been identified to have a vulnerability that allows local users to exploit terminal I/O operations.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2008-1845, originates from the mksh version prior to R33d on MirOS. It fails to flush the tty's I/O when invoked in a new terminal. This oversight allows local users to gain elevated privileges by opening a virtual terminal and executing command sequences that could later be executed by another user who specifies that terminal with the -T option. This could lead to unauthorized access or execution of commands with higher privileges than intended.
How To Fix
Minimum fixed version
33.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mkshTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the -T option when launching mksh in a new terminal. This will help mitigate the risk of privilege escalation until the package can be updated.
Conclusion
The mksh package has a privilege escalation vulnerability that can be exploited by local users. It is crucial to update the package to the patched version 33.4-1 or later to mitigate this risk. Users should also consider using workarounds until the update can be applied.
See every vulnerability recorded for mksh →
FAQ
mksh is a command-line shell that provides a user interface for executing commands and scripting in Unix-like operating systems.
The vulnerability allows local users to gain elevated privileges by exploiting terminal I/O operations, potentially executing commands with higher privileges.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update the mksh package immediately, avoid using the -T option when launching mksh in a new terminal as a temporary workaround.
More information about this vulnerability can be found in the Debian security advisory and the CVE database.
References
Related vulnerabilities
Recent vulnerabilities recorded for mksh.
