Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
mtr before 0.95 can run unwanted commands
published 1 year ago
Summary
The mtr network‑diagnostic tool (versions earlier than 0.95) can be tricked into executing any program you specify in the MTR_PACKET environment variable, especially when it is run with administrator rights. This could let an attacker run their own code on the system. Upgrade mtr to the latest version or stop running it with elevated privileges to eliminate the risk.
What to do
- Update azure mtr to version 0.95-3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | mtr |
< 0.95-3 Fix: upgrade to 0.95-3
|
Original advisory text
CVE-2025-49809 affecting package mtr for versions less than 0.95-3
mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may often have Sudo rules, as an indirect consequence of Homebrew not installing setuid binaries.
References
Timeline
Published4 Jul 2025
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-65232 · OSV
Track software like this
Free during beta