Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 595268 (CVE-2016-7543) - <app-shells/bash-4.3_p48: Specially crafted SHELLOPTS+PS4 variables allows command substitution
Summary: <app-shells/bash-4.3_p48: Specially crafted SHELLOPTS+PS4 variables allows co...
Status: RESOLVED FIXED
Alias: CVE-2016-7543
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: A2 [glsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2016-09-27 12:06 UTC by Agostino Sarubbo
Modified: 2017-01-01 13:47 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-09-27 12:06:21 UTC 
From ${URL} :

Shells running as root inherited PS4 from the environment, allowing PS4 expansion performing command substitution. Local attacker could gain arbitrary 
code execution via bogus setuid binaries using system()/popen() by specially crafting SHELLOPTS+PS4 environment variables.

Public announcement:

http://seclists.org/oss-sec/2016/q3/617


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2016-09-27 12:21:16 UTC 
commit 49dcef88c9b9d94334ae251a8f658739a19ccf3c
Author: Lars Wendler <polynomial-c@gentoo.org>
Date:   Tue Sep 27 14:17:05 2016

    package.mask: Unmasked bash-4.4/readline-7.0 for wider testing.


Since there seems to be no backported patch available I've unmasked bash-4.4

Let's wait a couple of days for stabilization call. I have the feeling that soon there will be some upstream patches available for bash-4.4 as well.
Comment 2 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2016-10-07 09:00:18 UTC 
commit 8a8e224a29a12f871d6adf7c53d85fd8e9e5b69f
Author: Lars Wendler <polynomial-c@gentoo.org>
Date:   Fri Oct 7 10:56:18 2016

    app-shells/bash: Bump to version 4.3_p48

    Package-Manager: portage-2.3.1
    Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>



Arches please test and mark stable =app-shells/bash-4.3_p48 with target KEYWORDS:

alpha amd64 arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd
Comment 3 Agostino Sarubbo gentoo-dev 2016-10-07 13:27:34 UTC 
amd64 stable
Comment 4 Agostino Sarubbo gentoo-dev 2016-10-07 13:28:01 UTC 
x86 stable
Comment 5 Jeroen Roovers (RETIRED) gentoo-dev 2016-10-08 12:43:58 UTC 
Stable for HPPA PPC64.
Comment 6 Tobias Klausmann (RETIRED) gentoo-dev 2016-10-11 14:18:32 UTC 
Stable on alpha
Comment 7 Markus Meier gentoo-dev 2016-10-18 19:47:27 UTC 
arm stable
Comment 8 SpanKY gentoo-dev 2016-11-10 14:05:37 UTC 
done the rest now
Comment 9 Thomas Deutschmann (RETIRED) gentoo-dev 2016-12-07 16:23:01 UTC 
Added to existing GLSA.
Comment 10 GLSAMaker/CVETool Bot gentoo-dev 2017-01-01 13:47:30 UTC 
This issue was resolved and addressed in
 GLSA 201701-02 at https://security.gentoo.org/glsa/201701-02
by GLSA coordinator Thomas Deutschmann (whissi).