SOL15629 - Multiple GNU Bash vulnerabilities

CVE-2014-6271 GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the...

GNU Bash Remote Code Execution (CVE-2014-6271; CVE-2014-6277; CVE-2014-6278; CVE-2014-7169; CVE-2014-7186; CVE-2014-7187)

A remote code execution vulnerability has been reported in several versions of GNU Bash. The vulnerability, aka ShellShock, is due to an error in the way GNU Bash processes trailing strings after function definitions in the values of environment variables...

Re: [oss-security] CVE-2014-6271: remote code execution through bash

Florian Weimer: Chet Ramey, the GNU bash upstream maintainer, will soon release official upstream patches. http://ftp.gnu.org/pub/gnu/bash/bash-3.0-patches/bash30-017 http://ftp.gnu.org/pub/gnu/bash/bash-3.1-patches/bash31-018 http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052...

CentOS Update for bash CESA-2014:1293 centos5

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RedHat Update for bash RHSA-2014:1293-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SuSE 11.3 Security Update : bash (SAT Patch Number 9740)

bash has been updated to fix a critical security issue. In some circumstances, the shell would evaluate shellcode in environment variables passed at startup time. This allowed code execution by local or remote attackers who could pass environment variables to bash scripts. CVE-2014-6271...

RHEL 6 / 7 : bash (RHSA-2014:1293)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:1293 advisory. The GNU Bourne Again shell Bash is a shell and command language interpreter compatible with the Bourne shell sh. Bash is the default shell for Re...

Re: [oss-security] CVE-2014-6271: remote code execution through bash

On Wed, Sep 24, 2014 at 04:05:51PM +0200, Florian Weimer wrote: Stephane Chazelas discovered a vulnerability in bash, related to how environment variables are processed: trailing code in function definitions was executed, independent of the variable name. In many common configurations, this...

Re: [oss-security] CVE-2014-6271: remote code execution through bash

On Wed, Sep 24, 2014 at 12:08:46PM -0400, Chet Ramey wrote: On 9/24/14, 11:16 AM, Solar Designer wrote: I see no good workaround. You're correct; there is not a good workaround. Since there are publicly available patches for all bash versions back 15 years or so, though, the best path forward is ...

Re: [oss-security] CVE-2014-6271: remote code execution through bash

Tavis Ormandy just tweetet this: https://twitter.com/taviso/status/514887394294652929 The bash patch seems incomplete to me, function parsing is still brittle. e.g. $ env X=' a=' sh -c "echo date"; cat echo -- Hanno Bock http://hboeck.de/ mail/jabber: [email protected] GPG: BBB51E42...

[USN-2362-1] Bash vulnerability

========================================================================== Ubuntu Security Notice USN-2362-1 September 24, 2014 bash vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...

GNU Bash Environment Variable Handling RCE Vulnerability (Shellshock, HTTP, CVE-2014-6271/CVE-2014-6278) - Active Check

GNU Bash is prone to a remote command execution RCE vulnerability dubbed SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS Update for bash CESA-2014:1293 centos7

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS Update for bash CESA-2014:1293 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-2362-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : bash -- remote code execution vulnerability (71ad81da-4414-11e4-a33e-3c970e169bc2) (Shellshock)

Chet Ramey reports : Under certain circumstances, bash will execute user code while processing the environment for exported function definitions. The original fix released for CVE-2014-6271 was not adequate. A similar vulnerability was discovered and tagged as CVE-2014-7169. %NASLMINLEVEL 70300 C...

The latest bash vulnerability solution-exploits warning-the black bar safety net

Is today just broke the Bash security vulnerability, and SSH bash emergency security patches is very important. Test whether the presence of the vulnerability you Please execute the following command: root@keepalivenginxmaster / env x=' :;; echo vulnerable" bash-c "echo this is a test" 1 2 3 4 5 ...

The threat is far better than“bleeding heart”for? Abroad new explosion Bash security vulnerability-vulnerability warning-the black bar safety net

These days Linux users can happily play the Red Hat security team yesterday broke a dangerous Bash Shell vulnerability. Its threat may be higher than the earlier disclosure of the“heartbleed”vulnerability is more and more strong! ! A network security company, Engineering Manager Tod Beardsley als...

DSA-3035-1 bash - security update

Bulletin has no description...

[oss-security] Re: CVE-2014-6271: remote code execution through bash

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITRE is currently using CVE-2014-7169 to track the report of the incomplete patch, i.e., incorrect function parsing that's present in builds that are up-to-date with the http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-025 changes. We realize that...