CVE-2016-1253
📋 TL;DR
This vulnerability in the 'most' pager utility allows remote attackers to execute arbitrary commands by exploiting shell metacharacters in LZMA-compressed filenames. Attackers can achieve remote code execution when users process malicious files. Affected systems include Debian wheezy, jessie, and unstable distributions with vulnerable most package versions.
💻 Affected Systems
- most (pager utility)
📦 What is this software?
Most by Debian
Most by Debian
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges via remote code execution, allowing data theft, backdoor installation, or complete system control.
Likely Case
Remote code execution with user privileges leading to lateral movement, data exfiltration, or privilege escalation.
If Mitigated
Limited impact if systems are patched, have restricted user privileges, or don't process untrusted LZMA files.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) but is straightforward once the file is processed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Debian wheezy: 5.0.0a-2.2+, Debian jessie: 5.0.0a-2.3+deb8u1+, Debian unstable: 5.0.0a-3+
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2016/12/msg00020.html
Restart Required: No
Instructions:
1. Update package list: sudo apt-get update
2. Upgrade most package: sudo apt-get install --only-upgrade most
3. Verify installation: dpkg -l | grep most
🔧 Temporary Workarounds
Avoid processing untrusted LZMA files
linuxDo not open or process LZMA-compressed files from untrusted sources with the most utility.
Use alternative pager
linuxTemporarily use less or more instead of most for file viewing.
export PAGER=less
🧯 If You Can't Patch
- Restrict user privileges to limit impact of potential code execution
- Implement strict file handling policies for compressed files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check most package version: dpkg -l | grep mostCheck Version:
dpkg -l most | awk '{print $3}'Verify Fix Applied:
Verify installed version matches patched versions: dpkg -l most📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from most utility
- Shell command execution with unexpected arguments
Network Indicators:
- Outbound connections from most process
- Unexpected network activity following file processing
SIEM Query:
process_name="most" AND (command_line="*sh*" OR command_line="*bash*" OR command_line="*cmd*" OR command_line="*powershell*")🔗 References
- http://seclists.org/oss-sec/2016/q4/666
- http://www.securityfocus.com/bid/94931
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848132
- https://lists.debian.org/debian-lts-announce/2016/12/msg00020.html
- http://seclists.org/oss-sec/2016/q4/666
- http://www.securityfocus.com/bid/94931
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848132
- https://lists.debian.org/debian-lts-announce/2016/12/msg00020.html
