Security Vulnerability : CVE-2014-6277 and CVE-2014-6278

This document (7015714) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 11 SP2 LTSS
SUSE Linux Enterprise Server 11 SP1 LTSS
SUSE Linux Enterprise Server 10 SP4 LTSS
SUSE Linux Enterprise Server 10 SP3 LTSS
SUSE Linux Enterprise Software Development Kit 11 SP3
SUSE Linux Enterprise Desktop 11 SP3
SUSE Linux Enterprise Server 11 SP3
SUSE Linux Enterprise Server 11 SP3 for VMware
SLES Expanded Support platform release 6.5
SLES Expanded Support platform release 510

Situation

SUSE has been made aware of the following two vulnerabilities:

CVE-2014-6278
CVE-2014-6277

Both vulnerabilities have been already mitigated within the update previously released for CVE-2014-7169. With this hardening enabled it is no longer possible for attackers to inject environment variables that are parsed as functions, effectively disabling the whole class of attacks against the bash parser.

In order to detect if your bash version is hardened and therefore not affected, the following test is available:

hello() { echo hello; } ; export -f hello ; env|grep hello

An output like:

hello=() { echo hello

Indicates a vulnerable version of bash

While:

BASH_FUNC_hello()=() { echo hello

Indicates a patched bash version

For further details and patches, please refer to
https://www.suse.com/security/cve/CVE-2014-7169/

Resolution

For information about CVE-2014-7169 see TID 7015702

Cause

CVE-2014-6278
CVE-2014-6277

Status

Security Alert

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.