PT-2012-1116 · Gnu+1 · Bash+1

Marcus Meissner · Publicado 2012-08-13 · Atualizado 2017-08-29 · CVE-2012-3410

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GNU Bash versions prior to 4.2 patch 33 GNU Bash versions prior to 4.2 p37

Description The issue is related to a stack-based buffer overflow in lib/sh/eaccess.c, which might allow local users to bypass intended restricted shell access. This can be achieved by using a long filename in /dev/fd, which is not properly handled when expanding the /dev/fd prefix. Multiple vulnerabilities in the bash package, specifically in versions before 4.2 p37, can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally.

Recommendations For GNU Bash versions prior to 4.2 patch 33, update to version 4.2 patch 33 or later. For GNU Bash versions prior to 4.2 p37, update to version 4.2 p37 or later. As a temporary workaround, consider restricting access to the /dev/fd directory to minimize the risk of exploitation.

Exploit

Correção

Link Following

Buffer Overflow

Enumeração de Fraquezas

CWE-59

CWE-119

Identificadores relacionados

BDU:2015-09645

CVE-2012-3410

SUSE-SU-2012_0988-1

SUSE-SU-2014_1214-1

Produtos afetados

Bash

Suse

Referências · 128

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/smtp/qmail_bash_env_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/advantech_switch_bash_env_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cups_bash_env_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/dhcp/bash_environment.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/vmware_bash_function_root.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/ftp/pureftpd_bash_env_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_mod_cgi_bash_env_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ipfire_bashbug_exec.rb · Exploit
• 🔥 https://github.com/opsxcq/exploit-CVE-2014-6271 · Exploit
• 🔥 https://github.com/hmlio/vaas-cve-2014-6271 · Exploit
• 🔥 https://github.com/b4keSn4ke/CVE-2014-6271 · Exploit
• 🔥 https://github.com/npm/ansible-bashpocalypse · Exploit
• 🔥 https://github.com/zalalov/CVE-2014-6271 · Exploit
• 🔥 https://github.com/0x00-0x00/CVE-2014-6271 · Exploit
• 🔥 https://github.com/akr3ch/CVE-2014-6271 · Exploit