« Volver al listado

CVE-2009-0854

Estado: ModificadaMedia (6.9)—

Untrusted search path vulnerability in dash 0.5.4, when used as a login shell, allows local users to execute arbitrary code via a Trojan horse .profile file in the current working directory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Dash — Dash

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-0854",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "security@ubuntu.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-03-11T14:19:15.390",
  "references": [
    {
      "url": "http://secunia.com/advisories/34205",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/34092",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-732-1",
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49216",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/34205",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/34092",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-732-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49216",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Untrusted search path vulnerability in dash 0.5.4, when used as a login shell, allows local users to execute arbitrary code via a Trojan horse .profile file in the current working directory."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de  ruta de búsqueda no confiable en dash v0.5.4, cuando es usada como un interprete de comandos para hacer login, permite a usuarios locales ejecutar código de su elección a través de un archivo troyanizado .profile en el directorio actual de trabajo."
    }
  ],
  "lastModified": "2026-06-16T23:05:57.970",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dash:dash:0.5.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E20B8CE9-D007-417F-8D4F-ADAB8E725FA8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@ubuntu.com"
}