[ASA-201804-5] zsh: arbitrary code execution

[Remi Gacogne]

Arch Linux Security Advisory ASA-201804-5
=========================================

Severity: High
Date    : 2018-04-11
CVE-ID  : CVE-2018-1100
Package : zsh
Type    : arbitrary code execution
Remote  : No
Link    : https://security.archlinux.org/AVG-669

Summary
=======

The package zsh before version 5.5-1 is vulnerable to arbitrary code
execution.

Resolution
==========

Upgrade to 5.5-1.

# pacman -Syu "zsh>=5.5-1"

The problem has been fixed upstream in version 5.5.

Workaround
==========

None.

Description
===========

A stack-based buffer overflow has been found in zsh <= 5.4.2, in the
checkmailpath() function, where unchecked strings from the MAILCHECK
variable are copied to a buffer.  A local, unprivileged user can create
a specially crafted message file, which, if used to set a custom "you
have new mail" message, leads to code execution in the context of the
user who receives the message. If the user affected is privileged, this
leads to privilege escalation.

Impact
======

A local attacker might be able to execute arbitrary code in the context
of another user.

References
==========

https://www.zsh.org/mla/workers/2018/msg00411.html
https://sourceforge.net/p/zsh/code/ci/31f72205630687c1cef89347863aab355296a27f/
https://security.archlinux.org/CVE-2018-1100

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20180415/a2339308/attachment.asc>