Gentoo Archives: gentoo-announce

From: Tobias Heinlein <keytoaster@g.o>
To: gentoo-announce@g.o
Subject: [gentoo-announce] [ GLSA 201409-10 ] Bash: Code Injection (Updated fix for GLSA 201409-09)
Date: Thu, 25 Sep 2014 13:57:46
Message-Id: 54241F0D.6040203@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 201409-10
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 http://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: High
8 Title: Bash: Code Injection (Updated fix for GLSA 201409-09)
9 Date: September 25, 2014
10 Bugs: #523592
11 ID: 201409-10
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 A parsing flaw related to functions and environments in Bash could
19 allow attackers to inject code. The unaffected packages listed in GLSA
20 201409-09 had an incomplete fix.
21
22 Background
23 ==========
24
25 Bash is the standard GNU Bourne Again SHell.
26
27 Affected packages
28 =================
29
30 -------------------------------------------------------------------
31 Package / Vulnerable / Unaffected
32 -------------------------------------------------------------------
33 1 app-shells/bash < 4.2_p48-r1 *>= 3.1_p18-r1
34 *>= 3.2_p52-r1
35 *>= 4.0_p39-r1
36 *>= 4.1_p12-r1
37 >= 4.2_p48-r1
38
39 Description
40 ===========
41
42 Stephane Chazelas reported that Bash incorrectly handles function
43 definitions, allowing attackers to inject arbitrary code
44 (CVE-2014-6271). Gentoo Linux informed about this issue in GLSA
45 201409-09.
46
47 Tavis Ormandy reported that the patch for CVE-2014-6271 was incomplete.
48 As such, this GLSA supersedes GLSA 201409-09.
49
50 Impact
51 ======
52
53 A remote attacker could exploit this vulnerability to execute arbitrary
54 commands even in restricted environments.
55
56 Workaround
57 ==========
58
59 There is no known workaround at this time.
60
61 Resolution
62 ==========
63
64 All Bash 3.1 users should upgrade to the latest version:
65
66 # emerge --sync
67 # emerge --ask --oneshot --verbose ">=app-shells/bash-3.1_p18-r1"
68
69 All Bash 3.2 users should upgrade to the latest version:
70
71 # emerge --sync
72 # emerge --ask --oneshot --verbose ">=app-shells/bash-3.2_p52-r1"
73
74 All Bash 4.0 users should upgrade to the latest version:
75
76 # emerge --sync
77 # emerge --ask --oneshot --verbose ">=app-shells/bash-4.0_p39-r1"
78
79 All Bash 4.1 users should upgrade to the latest version:
80
81 # emerge --sync
82 # emerge --ask --oneshot --verbose ">=app-shells/bash-4.1_p12-r1"
83
84 All Bash 4.2 users should upgrade to the latest version:
85
86 # emerge --sync
87 # emerge --ask --oneshot --verbose ">=app-shells/bash-4.2_p48-r1"
88
89 References
90 ==========
91
92 [ 1 ] CVE-2014-7169
93 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7169
94
95 Availability
96 ============
97
98 This GLSA and any updates to it are available for viewing at
99 the Gentoo Security Website:
100
101 http://security.gentoo.org/glsa/glsa-201409-10.xml
102
103 Concerns?
104 =========
105
106 Security is a primary focus of Gentoo Linux and ensuring the
107 confidentiality and security of our users' machines is of utmost
108 importance to us. Any security concerns should be addressed to
109 security@g.o or alternatively, you may file a bug at
110 https://bugs.gentoo.org.
111
112 License
113 =======
114
115 Copyright 2014 Gentoo Foundation, Inc; referenced text
116 belongs to its owner(s).
117
118 The contents of this document are licensed under the
119 Creative Commons - Attribution / Share Alike license.
120
121 http://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature