PT-2012-1116 · Gnu+1 · Bash+1

Marcus Meissner · Published 2012-08-13 · Updated 2017-08-29 · CVE-2012-3410

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GNU Bash versions prior to 4.2 patch 33 GNU Bash versions prior to 4.2 p37

Description The issue is related to a stack-based buffer overflow in lib/sh/eaccess.c, which might allow local users to bypass intended restricted shell access. This can be achieved by using a long filename in /dev/fd, which is not properly handled when expanding the /dev/fd prefix. Multiple vulnerabilities in the bash package, specifically in versions before 4.2 p37, can lead to breaches of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally.

Recommendations For GNU Bash versions prior to 4.2 patch 33, update to version 4.2 patch 33 or later. For GNU Bash versions prior to 4.2 p37, update to version 4.2 p37 or later. As a temporary workaround, consider restricting access to the /dev/fd directory to minimize the risk of exploitation.

Exploit

Fix

Link Following

Buffer Overflow

Weakness Enumeration

CWE-59

CWE-119

Related Identifiers

BDU:2015-09645

CVE-2012-3410

SUSE-SU-2012_0988-1

SUSE-SU-2014_1214-1

Affected Products

Bash

Suse

References · 128

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/smtp/qmail_bash_env_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/advantech_switch_bash_env_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/cups_bash_env_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/dhcp/bash_environment.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/osx/local/vmware_bash_function_root.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/ftp/pureftpd_bash_env_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_mod_cgi_bash_env_exec.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ipfire_bashbug_exec.rb · Exploit
• 🔥 https://github.com/opsxcq/exploit-CVE-2014-6271 · Exploit
• 🔥 https://github.com/hmlio/vaas-cve-2014-6271 · Exploit
• 🔥 https://github.com/b4keSn4ke/CVE-2014-6271 · Exploit
• 🔥 https://github.com/npm/ansible-bashpocalypse · Exploit
• 🔥 https://github.com/zalalov/CVE-2014-6271 · Exploit
• 🔥 https://github.com/0x00-0x00/CVE-2014-6271 · Exploit
• 🔥 https://github.com/akr3ch/CVE-2014-6271 · Exploit