GNU Bash CVE-2019-9924 Local Command Execution Vulnerability

Bugtraq ID:	109277
Class:	Design Error
CVE:	CVE-2019-9924
Remote:	No
Local:	Yes
Published:	Mar 22 2019 12:00AM
Updated:	Mar 22 2019 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Ubuntu Ubuntu Linux 16.04 LTS Redhat Virtualization 4 Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 NetApp Element Software Management Node 0 GNU GNU bash 3.1.4 GNU GNU bash 3.0.16 GNU GNU bash 2.3 GNU GNU bash 2.2.1 GNU GNU bash 2.2 GNU GNU bash 2.1 GNU GNU bash 2.0 GNU GNU bash 1.14.5 GNU GNU bash 1.14.3 GNU GNU bash 1.14.2 GNU GNU bash 1.14.1 GNU GNU bash 1.14 GNU GNU bash 4.3 GNU GNU bash 4.2 GNU GNU bash 4.1 GNU GNU bash 4.0 GNU GNU bash 3.2.48 GNU GNU bash 3.2 GNU GNU bash 2.05 GNU GNU bash 2.04 GNU GNU bash 2.03 GNU GNU bash 2.02 GNU GNU bash 2.01.1 GNU GNU bash 2.01 GNU GNU bash 1.14.7 GNU GNU bash 1.14.6 GNU GNU bash 1.14.4
Not Vulnerable:	GNU GNU bash 4.4-beta2

GNU Bash CVE-2019-9924 Local Command Execution Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

GNU Bash CVE-2019-9924 Local Command Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

GNU Bash CVE-2019-9924 Local Command Execution Vulnerability

References:

• BASH_CMDS is writable in restricted bash shells (fixed upstream, need to backpo (launchpad.net)
  
• root/CHANGES (gnu.org/)
  
• BASH Homepage (GNU)
  
• Bug 1691774 (CVE-2019-9924) - CVE-2019-9924 bash: BASH_CMD is writable in restr (Redhat)
  
• CVE-2019-9924 GNU Bash Vulnerability in NetApp Products (NetApp)
  
• USN-4058-1: Bash vulnerability (Ubuntu)
  
• [SECURITY] [DLA 1726-1] bash security update (Debian)
  
• CVE-2019-9924 (Redhat)