Skip to navigation

Warning message

log in to add comments or rate this document

Resolution for Bash Code Injection Vulnerability via Specially Crafted Environment Variables (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) in Red Hat Enterprise Linux

Updated 2014-09-30T19:38:49+00:00

Issue

Environment

  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 4 (ELS)

Resolution

These issues affect all software that uses the Bash shell and parses values of environment variables. These issues are especially dangerous as there are many possible ways Bash can be called by an application. Quite often if an application executes another binary, Bash is invoked to accomplish this. Because of the pervasive use of the Bash shell, these issues are quite serious and should be treated as such.

In order to avoid exploitation from CVE-2014-6271, ensure that your system is updated to at least the following versions of Bash:

RHSA-2014:1293

  • Red Hat Enterprise Linux 7 - bash-4.2.45-5.el7_0.2
  • Red Hat Enterprise Linux 6 - bash-4.1.2-15.el6_5.1
  • Red Hat Enterprise Linux 5 - bash-3.2-33.el5.1

RHSA-2014:1294

  • Red Hat Enterprise Linux 4 Extended Lifecycle Support - bash-3.0-27.el4.2
  • Red Hat Enterprise Linux 5.6 Long Life - bash-3.2-24.el5_6.1
  • Red Hat Enterprise Linux 5.9 Extended Update Support - bash-3.2-32.el5_9.2
  • Red Hat Enterprise Linux 6.2 Advanced Update Support - bash-4.1.2-9.el6_2.1
  • Red Hat Enterprise Linux 6.4 Extended Update Support - bash-4.1.2-15.el6_4.1

RHSA-2014:1295

  • SJIS for Red Hat Enterprise Linux 6 - bash-4.1.2-15.el6_5.1.sjis.1
  • SJIS for Red Hat Enterprise Linux 5 - bash-3.2-33.el5_11.1.sjis.1

In order to avoid exploitation from CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, and CVE-2014-6278, ensure that your system is updated to at least the following versions of Bash, which also includes the prior fixes:

RHSA-2014:1306

  • Red Hat Enterprise Linux 7 - bash-4.2.45-5.el7_0.4
  • Red Hat Enterprise Linux 6 - bash-4.1.2-15.el6_5.2
  • Red Hat Enterprise Linux 5 - bash-3.2-33.el5_11.4

RHSA-2014:1311

  • Red Hat Enterprise Linux 4 Extended Lifecycle Support - bash-3.0-27.el4.4
  • Red Hat Enterprise Linux 5.6 Long Life - bash-3.2-24.el5_6.2
  • Red Hat Enterprise Linux 5.9 Extended Update Support - bash-3.2-32.el5_9.3
  • Red Hat Enterprise Linux 6.2 Advanced Update Support - bash-4.1.2-9.el6_2.2
  • Red Hat Enterprise Linux 6.4 Extended Update Support - bash-4.1.2-15.el6_4.2

RHSA-2014:1312

  • SJIS for Red Hat Enterprise Linux 6 - bash-4.1.2-15.el6_5.1.sjis.2
  • SJIS for Red Hat Enterprise Linux 5 - bash-3.2-33.el5_11.1.sjis.2

In order to update to the most recent version of the Bash package run the following command:

# yum update bash

Specify the package name in order to update to a particular version of Bash. For example, to update a Red Hat Enterprise Linux 6.5 system run:

# yum update bash-4.1.2-15.el6_5.2

Root Cause

  • A flaw was found in the bash functionality that evaluates specially formatted environment variables passed to it from another environment.
    An attacker could use this feature to override or bypass restrictions to the environment to execute shell commands before restrictions have been applied. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue.

  • For more information about this vulnerability, refer to the following article:
    Bash Code Injection Vulnerability via Specially Crafted Environment Variables (CVE-2014-6271)

Diagnostic Steps

  • To determine if a system is affected by this vulnerability, review the version of Bash:
# rpm -qa bash