oss-security - RE: more bash parser bugs (CVE-2014-6277, CVE-2014-6278)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 2 Oct 2014 06:48:54 +0000
From: Sona Sarmadi <sona.sarmadi@...a.com>
To: Shawn <citypw@...il.com>
CC: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: RE: more bash parser bugs (CVE-2014-6277,
 CVE-2014-6278)

> On 10/1/14, 5:04 PM, Shawn wrote:
> > http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-028
> 
> Nope, this one fixes 7168/7169.  It's the equivalent of the `parser-oob' patch.

Chet is 7168 new vulnerability or is a typo and should be CVE-2014-7186?
Doesn't bash43-026  fix CVE-2014-7169?

Is this summary correct?
1) CVE-2014-6271 (Initial vulnerability, Bash Code Injection Vulnerability via Specially Crafted Environment Variables): GNU fix bash43-025  & bash32-052 

2) CVE-2014-7169 (Further parser error,  this was assigned to cover incomplete fix for CVE-2014-6271): GNU fix bash43-026  & bash32-053

3) CVE-2014-6277 (this is the hardening patch which adds function name mangling, it makes exploitation over the network impossible): Florian's patch /GNU fix bash43-027 & bash32-054

4) CVE-2014-6278 (bash: code execution via specially crafted environment): Florian's patch /GNU fix bash43-027 & bash32-054

5) CVE-2014-7186 (Out of bound memory read error in redir_stack): GNU fix bash43-028 ??

6) CVE-2014-7187 (Off-by-one error in nested loops): No upstream patch available yet ?

Thanks 
-- Sona

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.