CVE-2018-1000021
Description
It was found that the Git client printed server-sent ANSI escape codes to the terminal without any sanitization, leading to execution of arbitrary escape sequences in the terminal emulator. Exploitation of this flaw by a MitM attacker could potentially result in code execution, arbitrary file writes, or other attacks under highly specific circumstances dependent on the usage of a vulnerable terminal emulator by the user.
Statement
The vulnerability is considered moderate rather than important due to the specific and limited conditions required for exploitation. For an attack to succeed, a MitM attacker would need to intercept Git traffic and inject specially crafted ANSI escape sequences. The severity is mitigated by the fact that not all terminal emulators interpret escape sequences in a way that could result in code execution or harmful actions. Modern terminal emulators, especially those used in Red Hat Enterprise Linux, typically sanitize escape sequences or do not support dangerous behaviors like file manipulation or code execution triggered via ANSI sequences. As a result, the potential impact is constrained to terminal emulators with flawed handling of escape codes, reducing the overall risk.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5 | 5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | High | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | Required | Required | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | Low | Low | N/A |
| Integrity Impact | Low | Low | N/A |
| Availability Impact | Low | Low | N/A |
Vector
Red Hat: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
NVD: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Red Hat CVSS v3 Score Explanation
A successful exploitation required a MitM attacker who would need to have precise circumstances to inject malicious ANSI escape sequences into Git communications. Factors like the need for a vulnerable terminal emulator and the ability to intercept traffic significantly complicate the attack, making it less likely to occur, so Attack Complexity is High.
Some information may be exposed during exploitation, the extent is minimal as any data revealed through successful exploitation would likely be limited to what is displayed in the terminal, such as non-sensitive output or commands, rather than critical or sensitive information so Confidentiality Impact is Low.
An attacker might manipulate the terminal output or inject benign commands, but the actual integrity of files or system data would remain largely unaffected, so Integrity Impact is Low.
Also the attacker could potentially alter the display or behavior of the terminal, any disruptions would be minimal and temporary, without causing major service outages or impairing user access, means Availability Impact is also Low.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Non-Repudiation
Technical Impact: Execute Unauthorized Code or Commands; DoS: Crash, Exit, or Restart; Read Files or Directories; Modify Files or Directories; Read Application Data; Modify Application Data; Hide Activities
Attackers could execute unauthorized operating system commands, which could then be used to disable the product, or read and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker, any malicious activities may appear to come from the application or the application's owner.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
