CVE-2017-16926
📋 TL;DR
CVE-2017-16926 is a command injection vulnerability in Ohcount 3.0.0 that allows attackers to execute arbitrary code by providing specially crafted filenames containing shell metacharacters. This affects anyone running Ohcount 3.0.0 to process untrusted source trees, potentially leading to complete system compromise.
💻 Affected Systems
- Ohcount
📦 What is this software?
Ohcount by Ohcount Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with arbitrary code execution as the Ohcount user, potentially leading to privilege escalation, data theft, or complete system takeover.
Likely Case
Remote code execution leading to unauthorized access, data exfiltration, or installation of malware/backdoors on affected systems.
If Mitigated
Limited impact if Ohcount runs with minimal privileges, processes only trusted source trees, or is isolated in containers.
🎯 Exploit Status
Exploitation requires providing malicious filenames to Ohcount. The vulnerability is well-documented in Debian bug reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.0.0
Vendor Advisory: https://bugs.debian.org/882372
Restart Required: No
Instructions:
1. Upgrade Ohcount to version 4.0.0 or later. 2. Update through package manager: 'sudo apt update && sudo apt upgrade ohcount' on Debian/Ubuntu systems. 3. Verify installation with 'ohcount --version'.
🔧 Temporary Workarounds
Input Sanitization
linuxSanitize filenames before passing to Ohcount by removing shell metacharacters
find /path/to/source -name '*[!\w\d.-]*' -delete
rename 's/[^\w\d.-]//g' *
Container Isolation
linuxRun Ohcount in a container with limited privileges
docker run --rm -v $(pwd):/src alpine/ohcount:latest
🧯 If You Can't Patch
- Run Ohcount with minimal privileges using a dedicated low-privilege user account
- Only process trusted source trees and implement strict input validation for filenames
🔍 How to Verify
Check if Vulnerable:
Check Ohcount version: 'ohcount --version' should show 3.0.0. Also check if processing untrusted files.Check Version:
ohcount --versionVerify Fix Applied:
Verify version is >3.0.0 with 'ohcount --version'. Test with safe input to confirm functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual Ohcount process execution with shell metacharacters in arguments
- Suspicious command execution following Ohcount runs
Network Indicators:
- Unexpected outbound connections from Ohcount processes
- Data exfiltration patterns
SIEM Query:
process_name:"ohcount" AND command_line:"*[;|&`$()]*"