SB2019112815 - Privilege escalation in GNU Bash

Description

This security bulletin contains information about 1 security vulnerability.

1) Improper Check for Dropped Privileges (CVE-ID: CVE-2019-18276)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists in "disable_priv_mode()" function in shell.c due to the affected software attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded. A local user with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
• https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
• https://www.youtube.com/watch?v=-wGtxJ8opa8