Remote Command Execution Vulnerability in Most Package
Summary
CVE-2016-1253: The most package in Debian wheezy before 5.0.0a-2.2, in Debian jessie before 5.0.0a-2.3+deb8u1, and in Debian unstable before 5.0.0a-3 allows remote attackers to execute arbitrary commands via shell metacharacters in the... Affects most versions < 5.0.0a-3. Fixed in 5.0.0a-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'most' package is a pager program used in Unix-like operating systems to view text files one screen at a time. It is particularly useful for navigating large files and provides features such as scrolling, searching, and navigating through text. However, certain versions of 'most' in Debian distributions are vulnerable to a remote command execution flaw that allows attackers to execute arbitrary commands through crafted LZMA-compressed file names.
Vulnerability Detail
CVE-2016-1253 is a critical vulnerability affecting the 'most' package in Debian wheezy, jessie, and unstable versions prior to specified fixed versions. The flaw arises from improper handling of shell metacharacters in the names of LZMA-compressed files, enabling remote attackers to execute arbitrary commands. This vulnerability poses significant risks, including unauthorized access to system resources and potential data breaches, making it crucial for users to address it promptly.
How To Fix
Minimum fixed version
5.0.0a-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mostTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using LZMA-compressed files with shell metacharacters in their names until the package is updated. This reduces the risk of exploitation until a proper fix is applied.
Conclusion
The CVE-2016-1253 vulnerability in the 'most' package poses a significant risk of remote command execution. Users are strongly advised to upgrade to the latest version to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time, ensuring better security for your applications.
See every vulnerability recorded for most →
FAQ
CVE-2016-1253 is a vulnerability in the 'most' package that allows remote command execution through specially crafted LZMA-compressed file names.
Affected versions include 'most' in Debian wheezy before 5.0.0a-2.2, jessie before 5.0.0a-2.3+deb8u1, and unstable before 5.0.0a-3.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by analyzing the manifest file like package-lock.json.
If an immediate upgrade is not possible, avoid using LZMA-compressed files with shell metacharacters in their names as a temporary workaround.
The CVSS score for CVE-2016-1253 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for most.
