CVE-2015-9059
📋 TL;DR
CVE-2015-9059 is a command injection vulnerability in picocom's 'send and receive file' command that allows arbitrary command execution via shell injection. This affects all picocom users before version 2.0 who use the file transfer functionality. Attackers can execute commands with the privileges of the picocom process.
💻 Affected Systems
- picocom
📦 What is this software?
Picocom by Picocom Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges if picocom runs as root, allowing complete control over the affected system.
Likely Case
Arbitrary command execution with user privileges, potentially leading to privilege escalation, data theft, or lateral movement.
If Mitigated
Limited impact if picocom runs with minimal privileges and network access is restricted.
🎯 Exploit Status
Exploitation requires access to picocom's command interface; public exploit code exists in commit references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0 and later
Vendor Advisory: https://github.com/npat-efault/picocom/commit/1ebc60b20fbe9a02436d5cbbf8951714e749ddb1
Restart Required: No
Instructions:
1. Update picocom to version 2.0 or later. 2. For Debian/Ubuntu: apt-get update && apt-get install picocom. 3. For source: git clone https://github.com/npat-efault/picocom && cd picocom && make && sudo make install.
🔧 Temporary Workarounds
Disable file transfer functionality
linuxRemove or restrict access to the vulnerable 'send and receive file' command.
chmod -x /usr/bin/picocom (if not needed)
Use alternative serial tools like minicom
Run with minimal privileges
linuxExecute picocom as non-root user to limit potential damage.
sudo -u nobody picocom [options]
🧯 If You Can't Patch
- Restrict network access to systems running picocom using firewall rules.
- Monitor for unusual process execution from picocom sessions.
🔍 How to Verify
Check if Vulnerable:
Check picocom version: picocom --version | grep -q '^picocom 1' && echo 'VULNERABLE'Check Version:
picocom --versionVerify Fix Applied:
Verify version is 2.0 or later: picocom --version | grep -q '^picocom 2' && echo 'PATCHED'📡 Detection & Monitoring
Log Indicators:
- Unusual command execution from picocom process
- Shell commands in picocom logs
Network Indicators:
- Unexpected network connections from systems running picocom
SIEM Query:
process.name='picocom' AND command_line CONTAINS ';' OR command_line CONTAINS '|' OR command_line CONTAINS '&'🔗 References
- https://github.com/npat-efault/picocom/commit/1ebc60b20fbe9a02436d5cbbf8951714e749ddb1
- https://lists.debian.org/debian-lts-announce/2020/06/msg00030.html
- https://github.com/npat-efault/picocom/commit/1ebc60b20fbe9a02436d5cbbf8951714e749ddb1
- https://lists.debian.org/debian-lts-announce/2020/06/msg00030.html
