SB2015092701 - Ubuntu update for Bash

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Memory corruption (CVE-ID: CVE-2014-7186)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to out-of-bounds memory access while handling multiple "<<EOF" declarations. A remote attacker can trigger memory corruption and execute arbitrary code.

Exploitation example:

bash -c 'true <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF' ||  echo "CVE-2014-7186 vulnerable, redir_stack"

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

2) Off-by-one error (CVE-ID: CVE-2014-7187)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to off-by-one-error when handling deeply nested flow control constructs. A remote attacker can trigger memory corruption and execute arbitrary code with privileges of the current user.

Exploitation example:

(for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
echo "CVE-2014-7187 vulnerable, word_lineno"

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Remediation

Install update from vendor's website.

References

• http://www.ubuntu.com/usn/usn-2364-1/