Bug 896776 - (CVE-2014-6271) VUL-0: CVE-2014-6271: bash: unexpected code execution with environment variables
(CVE-2014-6271)
VUL-0: CVE-2014-6271: bash: unexpected code execution with environment variables
Status: RESOLVED WONTFIX
: 898477 (view as bug list)
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P2 - High : Critical
: ---
Assigned To: Security Team bot
Security Team bot
maint:running:58971:critical maint:re...
: DSLA_REQUIRED, DSLA_SOLUTION_PROVIDED
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2014-09-15 21:13 UTC by Marcus Meissner
Modified: 2019-05-01 16:20 UTC (History)
28 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
CVE-2014-6271-for-4.2.diff (2.42 KB, patch)
2014-09-17 11:55 UTC, Marcus Meissner
Details | Diff
funcdef-import-3.0.patch (2.41 KB, patch)
2014-09-18 15:20 UTC, Marcus Meissner
Details | Diff
funcdef-import-3.1.patch (2.41 KB, patch)
2014-09-18 15:20 UTC, Marcus Meissner
Details | Diff
funcdef-import-3.2.patch (2.41 KB, patch)
2014-09-18 15:21 UTC, Marcus Meissner
Details | Diff
funcdef-import-4.0.patch (2.41 KB, patch)
2014-09-18 15:21 UTC, Marcus Meissner
Details | Diff
funcdef-import-4.1.patch (2.41 KB, patch)
2014-09-18 15:22 UTC, Marcus Meissner
Details | Diff
funcdef-import-4.2.patch (2.41 KB, patch)
2014-09-18 15:22 UTC, Marcus Meissner
Details | Diff
funcdef-import-4.3.patch (3.06 KB, patch)
2014-09-18 15:23 UTC, Marcus Meissner
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Comment 5 Swamp Workflow Management 2014-09-16 05:23:53 UTC
An update workflow for this issue was started.
This issue was rated as critical.
Please submit fixed packages until 2014-09-18.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/58971
Comment 13 Marcus Meissner 2014-09-18 15:20:33 UTC
Created attachment 606872 [details]
funcdef-import-3.0.patch

from chet, 3.0 patch
Comment 14 Marcus Meissner 2014-09-18 15:20:56 UTC
Created attachment 606873 [details]
funcdef-import-3.1.patch

3.1 patch
Comment 15 Marcus Meissner 2014-09-18 15:21:19 UTC
Created attachment 606874 [details]
funcdef-import-3.2.patch

3.2 patch
Comment 16 Marcus Meissner 2014-09-18 15:21:41 UTC
Created attachment 606875 [details]
funcdef-import-4.0.patch

4.0 patch
Comment 17 Marcus Meissner 2014-09-18 15:22:04 UTC
Created attachment 606876 [details]
funcdef-import-4.1.patch

4.1 patch
Comment 18 Marcus Meissner 2014-09-18 15:22:37 UTC
Created attachment 606877 [details]
funcdef-import-4.2.patch

4.2 patch
Comment 19 Marcus Meissner 2014-09-18 15:23:13 UTC
Created attachment 606878 [details]
funcdef-import-4.3.patch

4.3 patch
Comment 21 Marcus Meissner 2014-09-22 08:04:13 UTC
final CRD 2014-09-24 14:00 UTC now set (Wednesday, 16:00 CEST)
Comment 23 Marcus Meissner 2014-09-24 14:13:30 UTC
is public now

Date: Wed, 24 Sep 2014 16:05:51 +0200
Subject: [oss-security] CVE-2014-6271: remote code execution through bash
From: Florian Weimer <fw@deneb.enyo.de>

Stephane Chazelas discovered a vulnerability in bash, related to how
environment variables are processed: trailing code in function
definitions was executed, independent of the variable name.

In many common configurations, this vulnerability is exploitable over
the network.

Chet Ramey, the GNU bash upstream maintainer, will soon release
official upstream patches.
Comment 24 Bernhard Wiedemann 2014-09-24 15:00:23 UTC
This is an autogenerated message for OBS integration:
This bug (896776) was mentioned in
https://build.opensuse.org/request/show/251815 Factory / bash
https://build.opensuse.org/request/show/251817 13.1 / bash
https://build.opensuse.org/request/show/251818 12.3 / bash
https://build.opensuse.org/request/show/251819 12.3 / bash
Comment 26 Bernhard Wiedemann 2014-09-24 16:00:13 UTC
This is an autogenerated message for OBS integration:
This bug (896776) was mentioned in
https://build.opensuse.org/request/show/251830 Factory / bash
Comment 27 Haral Tsitsivas 2014-09-24 18:21:29 UTC
Is there an ETA for release of an updated bash rpm for SLES11SP1 and SLES11SP3?
Comment 28 Marcus Meissner 2014-09-24 18:39:46 UTC
SLE updates are just going out as you read this.
Comment 29 Denis Roy 2014-09-24 19:29:58 UTC
Still not seeing them for SLES 11 SP3...
Comment 30 Bernhard Wiedemann 2014-09-24 20:00:39 UTC
This is an autogenerated message for OBS integration:
This bug (896776) was mentioned in
https://build.opensuse.org/request/show/251985 Evergreen:11.4 / bash
Comment 31 Marcus Meissner 2014-09-24 20:29:07 UTC
FWIW, i see the 11-sp3 bash update on my server.
Comment 32 Denis Roy 2014-09-24 20:31:32 UTC
Yep, we're pulling in patches now.  Thanks folks.
Comment 33 Swamp Workflow Management 2014-09-24 23:06:19 UTC
SUSE-SU-2014:1214-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (critical)
Bug References: 688469,770795,896776
CVE References: CVE-2012-3410,CVE-2014-0475
Sources used:
SUSE Linux Enterprise Server 10 SP3 LTSS (src):    bash-3.1-24.32.1
Comment 47 Swamp Workflow Management 2014-09-26 05:18:21 UTC
An update workflow for this issue was started.
This issue was rated as critical.
Please submit fixed packages until 2014-09-30.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/59113
Comment 49 Jun Hu 2014-09-26 07:23:29 UTC
my customer(has LTSS) asked new bash version for sles10sp2  x86_64  too.
Comment 55 Werner Frerichs 2014-09-26 10:14:38 UTC
I am still missing a new version for SLES 10 SP4, is there an ETA for the patch?
Comment 56 Marcus Meissner 2014-09-26 10:18:49 UTC
The SLES 10 SP4 LTSS update has been released. 

https://download.suse.com/patch/finder/?keywords=5aa8890d421145a022bf2205e01b3c68

Note that this needs a special LTSS contract.
Comment 60 Petr Uzel 2014-09-27 19:09:03 UTC
Note: massPTFs including fix for CVE-2014-7169 are in bug 898762.
Comment 61 Swamp Workflow Management 2014-09-28 10:05:24 UTC
openSUSE-SU-2014:1226-1: An update that solves two vulnerabilities and has one errata is now available.

Category: security (critical)
Bug References: 868822,895475,896776
CVE References: CVE-2014-2524,CVE-2014-6271
Sources used:
openSUSE 13.1 (src):    bash-4.2-68.4.1
openSUSE 12.3 (src):    bash-4.2-61.9.1
Comment 62 Swamp Workflow Management 2014-09-28 10:09:29 UTC
openSUSE-SU-2014:1238-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 896776
CVE References: CVE-2014-6271
Sources used:
openSUSE Evergreen 11.4 (src):    bash-4.1-20.31.1
Comment 63 Swamp Workflow Management 2014-09-28 19:04:25 UTC
openSUSE-SU-2014:1248-1: An update that contains security fixes can now be installed.

Category: security (important)
Bug References: 896776
CVE References: 
Sources used:
openSUSE Evergreen 11.4 (src):    bash-4.1-20.35.1
Comment 64 Bernhard Wiedemann 2014-09-29 09:02:27 UTC
This is an autogenerated message for OBS integration:
This bug (896776) was mentioned in
https://build.opensuse.org/request/show/252752 13.2 / bash
Comment 65 Swamp Workflow Management 2014-09-29 12:04:49 UTC
openSUSE-SU-2014:1254-1: An update that fixes four vulnerabilities is now available.

Category: security (critical)
Bug References: 895475,896776
CVE References: CVE-2014-6271,CVE-2014-7169,CVE-2014-7186,CVE-2014-7187
Sources used:
openSUSE 13.2 (src):    bash-4.2-75.4.1
Comment 66 Marcus Meissner 2014-09-29 12:09:05 UTC
    See also

    https://www.suse.com/support/shellshock/

    for how to get a fix on outdated/unsupported code streams.
Comment 67 Swamp Workflow Management 2014-09-30 15:06:43 UTC
SUSE-SU-2014:1260-1: An update that fixes one vulnerability is now available.

Category: security (critical)
Bug References: 896776
CVE References: CVE-2014-6271
Sources used:
SUSE Linux Enterprise Software Development Kit 12 (src):    bash-4.2-77.1
SUSE Linux Enterprise Server 12 (src):    bash-4.2-77.1
SUSE Linux Enterprise Desktop 12 (src):    bash-4.2-77.1
 12 (src):    bash-4.2-77.1
Comment 68 L3 Incident Coordination 2014-10-03 08:29:01 UTC
Closing L3:41648 (PTFs were provided).
Ales Novak
Comment 69 L3 Incident Coordination 2014-10-03 08:30:01 UTC
Closing L3:41647 (PTFs were provided).
Ales Novak
Comment 70 Leonardo Chiquitto 2014-10-03 14:09:51 UTC
*** Bug 898477 has been marked as a duplicate of this bug. ***
Comment 72 Swamp Workflow Management 2014-10-20 13:04:56 UTC
openSUSE-SU-2014:1308-1: An update that fixes three vulnerabilities is now available.

Category: security (moderate)
Bug References: 896776,898346
CVE References: CVE-2014-6271,CVE-2014-7169,CVE-2014-7187
Sources used:
openSUSE 12.3 (src):    bash-4.2-61.19.1
Comment 73 Bernhard Wiedemann 2014-11-03 15:00:52 UTC
This is an autogenerated message for OBS integration:
This bug (896776) was mentioned in
https://build.opensuse.org/request/show/259512 Factory / bash
Comment 75 Marcus Meissner 2015-06-26 09:21:17 UTC
This CVE was and is fixed for SLE 12 before the GA shipment.

There is incorrect version on our announcement pages, as we shipped a update during the RC phase of SLES 12.