In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

The remote NewStart CGSL host, running version MAIN 4.05, has mercurial packages installed that are affected by a vulnerability:

  - A flaw was found in the way hg serve --stdio command     in Mercurial handled command-line options. A remote,     authenticated attacker could use this flaw to execute     arbitrary code on the Mercurial server by using     specially crafted command-line options. (CVE-2017-9462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201709-18 (Mercurial: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mercurial. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process.
  Workaround :

    There is no known workaround at this time.

Several issues were discovered in Mercurial, a distributed revision control system.

  - CVE-2017-9462 (fixed in stretch only)     Jonathan Claudius of Mozilla discovered that     repositories served over stdio could be tricked into     granting authorized users access to the Python debugger.

  - CVE-2017-1000115     Mercurial's symlink auditing was incomplete, and could     be abused to write files outside the repository.

  - CVE-2017-1000116     Joern Schneeweisz discovered that Mercurial did not     correctly handle maliciously constructed ssh:// URLs.
    This allowed an attacker to run an arbitrary shell     command.

According to the version of the mercurial package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In Mercurial before 4.1.3, 'hg serve --stdio' allows     remote authenticated users to launch the Python     debugger, and consequently execute arbitrary code, by     using --debugger as a repository name.(CVE-2017-9462)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for mercurial is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects.

Security Fix(es) :

* A flaw was found in the way 'hg serve --stdio' command in Mercurial handled command-line options. A remote, authenticated attacker could use this flaw to execute arbitrary code on the Mercurial server by using specially crafted command-line options. (CVE-2017-9462)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Python debugger accessible to authorized users :

A flaw was found in the way 'hg serve --stdio' command in Mercurial handled command-line options. A remote, authenticated attacker could use this flaw to execute arbitrary code on the Mercurial server by using specially crafted command-line options. (CVE-2017-9462)

In Mercurial before 4.1.3, 'hg serve --stdio' allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.

For Debian 7 'Wheezy', these problems have been fixed in version 2.2.2-4+deb7u4.

We recommend that you upgrade your mercurial packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for mercurial is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects.

Security Fix(es) :

* A flaw was found in the way 'hg serve --stdio' command in Mercurial handled command-line options. A remote, authenticated attacker could use this flaw to execute arbitrary code on the Mercurial server by using specially crafted command-line options. (CVE-2017-9462)

Security Fix(es) :

  - A flaw was found in the way 'hg serve --stdio' command     in Mercurial handled command-line options. A remote,     authenticated attacker could use this flaw to execute     arbitrary code on the Mercurial server by using     specially crafted command-line options. (CVE-2017-9462)

From Red Hat Security Advisory 2017:1576 :

An update for mercurial is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects.

Security Fix(es) :

* A flaw was found in the way 'hg serve --stdio' command in Mercurial handled command-line options. A remote, authenticated attacker could use this flaw to execute arbitrary code on the Mercurial server by using specially crafted command-line options. (CVE-2017-9462)

Fixes CVE-2017-9462.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mercurial fixes the following issues :

  - CVE-2017-9462: Fix the arbitrary code exec by remote     users via 'hg serve --stdio' (boo#1043063)

ID	Name	Product	Family	Severity
127335	NewStart CGSL MAIN 4.05 : mercurial Vulnerability (NS-SA-2019-0104)	Nessus	NewStart CGSL Local Security Checks	high
103446	GLSA-201709-18 : Mercurial: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
102930	Debian DSA-3963-1 : mercurial - security update	Nessus	Debian Local Security Checks	critical
102480	EulerOS 2.0 SP2 : mercurial (EulerOS-SA-2017-1133)	Nessus	Huawei Local Security Checks	high
102479	EulerOS 2.0 SP1 : mercurial (EulerOS-SA-2017-1132)	Nessus	Huawei Local Security Checks	high
101487	Virtuozzo 6 : emacs-mercurial / emacs-mercurial-el / mercurial / etc (VZLSA-2017-1576)	Nessus	Virtuozzo Local Security Checks	high
101273	Amazon Linux AMI : mercurial (ALAS-2017-856)	Nessus	Amazon Linux Local Security Checks	high
101121	Debian DLA-1005-1 : mercurial security update	Nessus	Debian Local Security Checks	high
101091	CentOS 6 / 7 : mercurial (CESA-2017:1576)	Nessus	CentOS Local Security Checks	high
101079	Scientific Linux Security Update : mercurial on SL6.x, SL7.x i386/x86_64 (20170627)	Nessus	Scientific Linux Local Security Checks	high
101077	RHEL 6 / 7 : mercurial (RHSA-2017:1576)	Nessus	Red Hat Local Security Checks	high
101076	Oracle Linux 6 / 7 : mercurial (ELSA-2017-1576)	Nessus	Oracle Linux Local Security Checks	high
101071	Fedora 24 : mercurial (2017-b154ff2892)	Nessus	Fedora Local Security Checks	high
101054	Fedora 25 : mercurial (2017-62aacc1474)	Nessus	Fedora Local Security Checks	high
100830	openSUSE Security Update : mercurial (openSUSE-2017-689)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2017-9462

high

Tenable Plugins

high

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high