Security update for bash
SUSE Security Update: Security update for bash
bash has been updated to fix a critical security issue.
In some circumstances, the shell would evaluate shellcode in environment
variables passed at startup time. This allowed code execution by local or
remote attackers who could pass environment variables to bash scripts.
(CVE-2014-6271)
Additionally, the following bugs have been fixed:
* Avoid possible buffer overflow when expanding the /dev/fd prefix
with e.g. the test built-in. (CVE-2012-3410)
* Enable workaround for changed behavior of sshd. (bnc#688469)
Security Issues:
* CVE-2014-6271
* CVE-2012-3410
| Announcement ID: | SUSE-SU-2014:1214-1 |
| Rating: | critical |
| References: | #688469 #770795 #896776 |
| Affected Products: |
An update that solves two vulnerabilities and has one errata is now available.
Description:
bash has been updated to fix a critical security issue.
In some circumstances, the shell would evaluate shellcode in environment
variables passed at startup time. This allowed code execution by local or
remote attackers who could pass environment variables to bash scripts.
(CVE-2014-6271)
Additionally, the following bugs have been fixed:
* Avoid possible buffer overflow when expanding the /dev/fd prefix
with e.g. the test built-in. (CVE-2012-3410)
* Enable workaround for changed behavior of sshd. (bnc#688469)
Security Issues:
* CVE-2014-6271
* CVE-2012-3410
Package List:
- SUSE Linux Enterprise Server 10 SP3 LTSS (i586 s390x x86_64):
- bash-3.1-24.32.1
- readline-5.1-24.32.1
- readline-devel-5.1-24.32.1
- SUSE Linux Enterprise Server 10 SP3 LTSS (s390x x86_64):
- readline-32bit-5.1-24.32.1
- readline-devel-32bit-5.1-24.32.1
References:
- http://support.novell.com/security/cve/CVE-2012-3410.html
- http://support.novell.com/security/cve/CVE-2014-0475.html
- https://bugzilla.suse.com/688469
- https://bugzilla.suse.com/770795
- https://bugzilla.suse.com/896776
- http://download.suse.com/patch/finder/?keywords=fd9fa24daf4d325c609035f0c778a723