[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Bash-4.3 Official Patch 25 Bug 896776 - (CVE-2014-6271)

From: ralf . naegele
Subject: Bash-4.3 Official Patch 25 Bug 896776 - (CVE-2014-6271)
Date: Thu, 25 Sep 2014 17:33:38 +0200 (CEST)


I've downloaded the source for bash 4.3 and all patches, patched the source to 
Patch 25. 
But according some description I've found (http://heise.de/-2403305 sorry, only 
in German
available), you can test with the command

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

if your bash is vulnerable. But according this test the bash 4.3 with patch 25 
still vulnerable. I've tried this test with other Linux servers, where the 
bash binaries came from the repositories (Ubuntu, CentOS), where this test now 

So my question: is bash in this version with patch 25 still vulnerable to 

With kind regards,

Configuration Information [Automatically generated, do not change]:
Machine: i686
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i686' 
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='i686-pc-linux-gnu' 
-DCONF_VENDOR='pc' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash' -DSHELL 
-DHAVE_CONFIG_H   -I.  -I. -I./include -I./lib   -g -O2
uname output: Linux pinie #1 SMP Tue Apr 17 08:42:35 UTC 
2007 i686 athlon i386 GNU/Linux
Machine Type: i686-pc-linux-gnu

Bash Version: 4.3
Patch Level: 25
Release Status: release

        [Detailed description of the problem, suggestion, or complaint.]

        [Describe the sequence of events that causes the problem
        to occur.]

        [Description of how to fix the problem.  If you don't know a
        fix for the problem, don't include this section.]

reply via email to

[Prev in Thread] Current Thread [Next in Thread]