Re: CVE-2014-6271 – remote code execution through bash
1–10 of 52 posts
Re: Re: CVE-2014-6271 – remote code execution through bash
#2Available on Debian now.
Re: Re: CVE-2014-6271 – remote code execution through bash
#3Ubuntu: http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20...
RHEL: https://rhn.redhat.com/errata/RHSA-2014-1306.html
CentOS update is available also - just not on some mirrors yet.
Re: Re: CVE-2014-6271 – remote code execution through bash
#4Debian patched this 8 hours ago, Redhat issued a patch about 3 hours ago, I believe Centos is still vulnerable, Ubuntu 14.10 isn't patched yet, Ubuntu 14.04 was patched about 3 hours ago.
Re: Re: CVE-2014-6271 – remote code execution through bash
#5Very thankful this made it out today.
Re: Re: CVE-2014-6271 – remote code execution through bash
#6Ubuntu: http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20... RHEL: https://rhn.redhat.com/errata/RHSA-2014-1306.html CentOS update is available also - just not on some mirrors yet.
I just patched my CentOS 6 server a few hours ago. Double check yum.
Re: Re: CVE-2014-6271 – remote code execution through bash
#72nd CentOS update is out too https://news.ycombinator.com/item?id=8371164
Re: Re: CVE-2014-6271 – remote code execution through bash
#8Not having worked with bash (et al) in ages I wonder whether allowing a function definition (even without trailing commands) is not still hole? What if you defined a function 'ls() { evil... }'... could a CGI script making a call to 'ls' actually end up with the function instead of the real 'ls'?
Re: Re: CVE-2014-6271 – remote code execution through bash
#9Ubuntu: http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20... RHEL: https://rhn.redhat.com/errata/RHSA-2014-1306.html CentOS update is available also - just not on some mirrors yet.
I just patched my CentOS 6 server a few hours ago. Double check yum.
I patched mine about 10 hours ago. Is this one newer?
Re: Re: CVE-2014-6271 – remote code execution through bash
#10Not having worked with bash (et al) in ages I wonder whether allowing a function definition (even without trailing commands) is not still hole? What if you defined a function 'ls() { evil... }'... could a CGI script making a call to 'ls' actually end up with the function instead of the real 'ls'?
Yes, but if you can control enviroment variable names then you can also set LD_PRELOAD and a whole load of other nasty enviroment variables.