Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 523
Alerts This Week
Warning Icon 1 523

Ubuntu 14.04 LTS: Critical Bash Memory Exploit Severity 2364-1 Explained

ubuntu
Calendar Grey September 27, 2014
Scroller Ubuntu
Tackling Bash weaknesses in Ubuntu versions through critical upgrade procedures to bolster system protection.
Several security issues were fixed in Bash.

Summary

Several security issues were fixed in Bash.

Software Description:

- bash: GNU Bourne Again SHell

Details:

Florian Weimer and Todd Sabin discovered that the Bash parser incorrectly

handled memory. An attacker could possibly use this issue to bypass certain

environment restrictions and execute arbitrary code. (CVE-2014-7186,

CVE-2014-7187)

In addition, this update introduces a hardening measure which adds prefixes

and suffixes around environment variable names which contain shell

functions.

Topics%20covered

Topics Covered

security advisory critical issue code execution update instructions memory issue ubuntu bash

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS:
  bash                            4.3-7ubuntu1.4

Ubuntu 12.04 LTS:
  bash                            4.2-2ubuntu2.5

Ubuntu 10.04 LTS:
  bash                            4.1-2ubuntu3.4

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2364-1

CVE-2014-7186, CVE-2014-7187

Severity
critical
Lowest
Low
Medium
High
Critical

September 27, 2014

Topics%20covered

Topics Covered

security advisory critical issue code execution update instructions memory issue ubuntu bash

Package Information

https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.4
https://launchpad.net/ubuntu/+source/bash/4.2-2ubuntu2.5
https://launchpad.net/ubuntu/+source/bash/4.1-2ubuntu3.4

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.