Command Injection Vulnerability in Picocom Package
Summary
DEBIAN-CVE-2015-9059: picocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin/sh unsafely. Affects picocom versions < 1.7-2. Fixed in 1.7-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Picocom is a minimal terminal emulation program designed for communication with serial devices. It is lightweight and often used for embedded systems and debugging purposes. The package allows users to send and receive files over serial connections, but it has a critical vulnerability that can be exploited through unsafe command execution.
Vulnerability Detail
The vulnerability identified as CVE-2015-9059 exists in Picocom versions prior to 2.0. It arises from the way the 'send and receive file' command is executed. Specifically, the command line is passed to /bin/sh without proper sanitization, allowing an attacker to inject arbitrary commands. This could lead to unauthorized command execution on the host system, potentially compromising the integrity and confidentiality of the system.
How To Fix
Minimum fixed version
1.7-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade picocomTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should avoid using the 'send and receive file' command in Picocom until the package is updated to a secure version. Additionally, users can restrict the execution of Picocom in environments where command injection could pose a significant risk.
Conclusion
The command injection vulnerability in Picocom poses a significant risk to users, especially in environments where serial communication is critical. It is essential to update to the latest version to mitigate this risk. Users are encouraged to monitor their software for vulnerabilities using tools like Vulert, which can provide real-time alerts without requiring extensive setup.
See every vulnerability recorded for picocom →
FAQ
CVE-2015-9059 is a command injection vulnerability found in Picocom versions before 2.0, allowing attackers to execute arbitrary commands.
You can check your version of Picocom by running the command 'picocom --version' in your terminal.
If left unaddressed, this vulnerability could allow attackers to execute malicious commands, potentially leading to data breaches or system compromise.
Yes, tools like Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file.
Detailed information can be found in the Debian CVE database or by visiting the Vulert website.
References
Related vulnerabilities
Recent vulnerabilities recorded for picocom.
