Description
Vulnerabilities: CVE-2014-6271, CVE-2014-7169
Here is an explanation of how the vulnerability works:
http://seclists.org/oss-sec/2014/q3/650
Steps to Test
1 - Please SSH into the Console of AO (Super, Worker, or Collector) as root
2 - Run the following Command:
- env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
Affected Output
vulnerable
this is a test
Patch Instructions
1 - cd /etc/yum.repos.d
2 - cp ../yum.repos.d.orig/CentOS-* /etc/yum.repos.d/
- NOTE: If the above copy command does not work please run the following:
- ls -l /etc/yum.repos.d/
- Make sure CentOS-Base.repo is in this directory
- If the above file is there - Please move forward to step 3
3 - yum update bash -y
4 - Test Again: env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
Expected results
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
NOTE: Latest Bash patch will have the following result only:
this is a test
