Login Sign Up

CVE-2016-1239

9.8 CRITICAL
Path Traversal

📋 TL;DR

This vulnerability in duck (a software package) before version 0.10 allows arbitrary code execution by loading untrusted code from the current directory. It affects systems running duck versions prior to 0.10, potentially enabling attackers to execute malicious code with the privileges of the duck process.

💻 Affected Systems

Products:
  • duck
Versions: All versions before 0.10
Operating Systems: Linux, Unix-like systems
Default Config Vulnerable: ⚠️ Yes
Notes: Vulnerability exists when duck loads code from current working directory, which is default behavior.

📦 What is this software?

Duck by Debian

View all CVEs affecting Duck →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, or ransomware deployment.

🟠

Likely Case

Local privilege escalation or arbitrary code execution when users run duck from untrusted directories.

🟢

If Mitigated

Limited impact if proper directory permissions and user privilege separation are implemented.

🌐 Internet-Facing: MEDIUM - Requires user interaction or specific configuration to be remotely exploitable.
🏢 Internal Only: HIGH - Easily exploitable by local users or through phishing attacks that trick users into running duck from malicious directories.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires tricking a user to run duck from a malicious directory containing crafted files.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 0.10 and later

Vendor Advisory: https://salsa.debian.org/debian/duck/-/commit/b43b5bbf07973c54b8f1c581a941f4facc97177a

Restart Required: No

Instructions:

1. Update duck to version 0.10 or later using your package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt install duck. 3. Verify installation with duck --version.

🔧 Temporary Workarounds

Restrict directory permissions

linux

Prevent execution of duck from untrusted directories by setting proper permissions.

chmod 750 /usr/bin/duck
chown root:root /usr/bin/duck

Run with minimal privileges

linux

Execute duck with non-privileged user accounts to limit potential damage.

sudo -u nobody duck [options]

🧯 If You Can't Patch

  • Restrict duck execution to trusted directories only
  • Implement strict file system permissions and monitor for suspicious duck process execution

🔍 How to Verify

Check if Vulnerable:

Check duck version: duck --version. If version is below 0.10, system is vulnerable.

Check Version:

duck --version

Verify Fix Applied:

After update, run duck --version and confirm version is 0.10 or higher.

📡 Detection & Monitoring

Log Indicators:

  • Unexpected duck process execution from unusual directories
  • Failed duck execution attempts

Network Indicators:

  • Unusual outbound connections from duck processes

SIEM Query:

process.name="duck" AND process.parent.name NOT IN ("bash", "sh", "zsh")

📊 Metadata

CVE ID: CVE-2016-1239
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: February 19, 2022
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON