GNU Bash CVE-2014-6277 Incomplete Fix Remote Code Execution Vulnerability

Bugtraq ID:	70165
Class:	Design Error
CVE:	CVE-2014-6277
Remote:	Yes
Local:	No
Published:	Sep 27 2014 12:00AM
Updated:	Oct 26 2015 04:51PM
Credit:	Michal Zalewski
Vulnerable:	Xerox WorkCentre 7245 Xerox WorkCentre 7242 Xerox WorkCentre 7238 Xerox WorkCentre 7235 Xerox WorkCentre 7232 Xerox WorkCentre 7228 Xerox Phaser 7800 0 Xerox Phaser 6700 0 Xerox ColorQube 9393 Xerox ColorQube 9303 Xerox ColorQube 9302 Xerox ColorQube 9301 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Sun Solaris 11 RedHat Enterprise Linux 5.0 RedHat Enterprise Linux 5 Client Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux Long Life 5.6 server Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux 5 Server Oracle VM VirtualBox 3.2 Oracle VM VirtualBox 3.1 Oracle Linux 5 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Oracle Enterprise Linux 5 McAfee Email Gateway 7.0 Patch 1 McAfee Email Gateway 7.0 McAfee Email Gateway 6.7.2 Hotfix 2 McAfee Email Gateway 6.7.2 Hotfix 1 IBM DS8000 0 IBM AIX 7.1 IBM AIX 6.1 IBM AIX 5.3 HP Insight Control 0 GNU GNU bash 3.1.4 GNU GNU bash 3.0.16 GNU GNU bash 4.2 GNU GNU bash 4.1 GNU GNU bash 4.0 RC1 GNU GNU bash 4.0 GNU GNU bash 3.2.48 GNU GNU bash 3.2 GNU GNU bash 3.00.0(2) GNU GNU bash 3.0 Gentoo Linux Cosmicperl Directory Pro 10.0.3 Cisco Wide Area Application Services (WAAS) 0 Cisco Unified IP Phone 0 Cisco Unified Contact Center Express 0 Cisco Network Analysis Module 0 Cisco MDS 0 Cisco GSS 4492R Global Site Selector 0 Cisco Emergency Responder 1.1 Cisco Digital Media Manager (DMM) 5.0 Cisco Digital Media Manager 0 Cisco Cisco Show and Share 5(2) Avaya 96x1 IP Deskphone 6.2 Avaya 96x1 IP Deskphone 6 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.10 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apple Mac OS X 10.2.8 Apple Mac OS X 10.2.7 Apple Mac OS X 10.2.6 Apple Mac OS X 10.2.5 Apple Mac OS X 10.2.4 Apple Mac OS X 10.2.3 Apple Mac OS X 10.2.2 Apple Mac OS X 10.2.1 Apple Mac OS X 10.2 Apple Mac OS X 10.1.5 Apple Mac OS X 10.1.4 Apple Mac OS X 10.1.3 Apple Mac OS X 10.1.2 Apple Mac OS X 10.1.1 Apple Mac OS X 10.1 Apple Mac OS X 10.0.4 Apple Mac OS X 10.0.2 Apple Mac OS X 10.0.1 Apple Mac OS X 10.0 3 Apple Mac OS X 10.0 Apple Mac Os X 10.7.4 Apple Mac Os X 10.7.3 Apple Mac Os X 10.7.2 Apple Mac Os X 10.7.1 Apple Mac OS X 10.6 Apple Mac OS X 10.5
Not Vulnerable:

GNU Bash CVE-2014-6277 Incomplete Fix Remote Code Execution Vulnerability

GNU Bash is prone to remote code execution vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Note: This issue exists due to an incomplete fix for CVE-2014-6271 and CVE-2014-7169. (identified in BID 70103 - GNU Bash CVE-2014-6271 Remote Code Execution Vulnerability and BID 70137 - GNU Bash CVE-2014-7169 Incomplete Fix Remote Code Execution Vulnerability respectively).

GNU Bash CVE-2014-6277 Incomplete Fix Remote Code Execution Vulnerability

The following exploit and proof-of-concept are available:

HTTP_COOKIE="() { x() { _; }; x() { _; } <<`perl -e '{print "A"x1000}'`; }" bash -c :

• /data/vulnerabilities/exploits/70165.py

GNU Bash CVE-2014-6277 Incomplete Fix Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

GNU Bash CVE-2014-6277 Incomplete Fix Remote Code Execution Vulnerability

References:

• BASH Homepage (GNU)