This repository was archived by the owner on Nov 9, 2017. It is now read-only.
Repository navigation
This repository was archived by the owner on Nov 9, 2017. It is now read-only.
Bash Remote Exploit Vulnerability via env. var [CVE-2014-6271 / CVE-2014-7169] #253
Description
Activity
Thanks. Already known.
Looks like the Bash maintainer has released the final (?) patches: http://seclists.org/oss-sec/2014/q3/734
@sschuberth Nobody knows if this is final or not. I'll guess we wait a few more days until the dust settles?
People wanting a hotfix can cherry-pick https://github.com/t-b/msysgit/commit/1719114310415271451e4bb886db1d3a3e676211.
I've incorporated one more patch release. Now four known vulnerabilties are fixed, according to some news site a fifth one is coming.
Hotfix: https://github.com/t-b/msysgit/commit/acfe307ec97c9bf72ef46018be11826f645e8bdc
Fixed in the latest release.
Metadata
Metadata
Assignees
Labels
No labels
A vulnerability in Bash up to 4.3 was discovered and allows for remote execution by defining a user-controlled environment variable to a specially crafted function definition.
While the attack surface is probably very limited in a desktop scenario (it would happen when a script is spawned by mod_cgi, for instance), it would still be a good idea to plug the hole.
As of this writing, an incomplete fix was released for CVE-2014-6271; I suggest waiting for a revised solution.