FKIE_CVE-2008-1845

Vulnerability from fkie_nvd - Published: 2008-04-16 17:05 - Updated: 2026-06-16 22:52
Severity
Summary
The Korn shell (aka mksh) before R33d on MirOS (aka MirBSD) does not flush the tty's I/O when invoking mksh in a new terminal, which allows local users to gain privileges by opening a virtual terminal and entering command sequences, which might later be executed in opportunistic circumstances by a different user who launches mksh and specifies that terminal with the -T option.
References
cve@mitre.orghttp://secunia.com/advisories/29803Vendor Advisory
cve@mitre.orghttp://www.mirbsd.org/mksh.htm#clog
cve@mitre.orghttp://www.osvdb.org/44365
cve@mitre.orghttp://www.securityfocus.com/bid/28768
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/41794
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29803Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.mirbsd.org/mksh.htm#clog
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/44365
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/28768
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/41794
Impacted products
Vendor Product Version
mirbsd miros *
mirbsd miros 33
mirbsd miros 33
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:mirbsd:miros:*:c:*:*:*:*:*:*",
              "matchCriteriaId": "EA2CBA6E-BBEC-4FD6-B32A-1748F6528339",
              "versionEndIncluding": "33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:mirbsd:miros:33:a:*:*:*:*:*:*",
              "matchCriteriaId": "EE115BFE-1E0D-4E7D-992A-FFDB4B765EB9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:mirbsd:miros:33:b:*:*:*:*:*:*",
              "matchCriteriaId": "1E87BD42-6F51-4E8E-93DE-9DA8B478A078",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Korn shell (aka mksh) before R33d on MirOS (aka MirBSD) does not flush the tty\u0027s I/O when invoking mksh in a new terminal, which allows local users to gain privileges by opening a virtual terminal and entering command sequences, which might later be executed in opportunistic circumstances by a different user who launches mksh and specifies that terminal with the -T option."
    },
    {
      "lang": "es",
      "value": "El int\u00e9rprete de comandos Korn (tambi\u00e9n conocido como mksh) antes de R33d en MirOS (tambi\u00e9n conocido como MirBSD) no renueva la E/S tty cuando invoca a mksh en un terminal nuevo, lo que permite a usuarios locales obtener privilegios abriendo un terminal virtual e introduciendo secuencias de comandos,  que se podr\u00edan ejecutar posteriormente en circunstancias oportunas por un usuario distinto que lance mksh y especifique ese terminal con la opci\u00f3n -T."
    }
  ],
  "id": "CVE-2008-1845",
  "lastModified": "2026-06-16T22:52:37.120",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.2,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-04-16T17:05:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/29803"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.mirbsd.org/mksh.htm#clog"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.osvdb.org/44365"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/28768"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41794"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/29803"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mirbsd.org/mksh.htm#clog"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/44365"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/28768"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41794"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.