vendor:
groff and standard troff
by:
Pawel Wilk
2.1
CVSS
LOW
Local root compromise
N/A
CWE
Product Name: groff and standard troff
Affected Version From: GNU groff prior to release 1.11a
Affected Version To: Standard troff
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
1999
GNU groff and standard troff Vulnerabilities
Versions of GNU groff prior to release 1.11a and standard troff contain vulnerabilities that can possibly lead to a local root compromise if the conditions are right and circumstances are somehow met. A malicious user can, in theory, embed t/g|roff macros inside of man pages that will execute with the uid of the unknowing reader. A groff example of this is a manpage that, once read as root, will add another user to /etc/passwd with uid0 and no password. To execute a command and display the output, the macro .pso can be used. While troff has fixed some of these, or at least disabled them by default, old vulnerabilities still exist such as .sy and .pi which respectively execute commands a la system() and pipe output to a program.
Mitigation:
Set proper permissions to prevent exploitation of this vulnerability.
