bash-doc 3.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/cb#####.? temporary file, related to the (1) aliasconv.sh, (2) aliasconv.bash, and (3) cshtobash scripts.

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2011-1073 advisory.

    [3.2-32]
    - Dont include backup files       Resolves: #700157

    [3.2-31]
    - Use 'mktemp' for temporary files       Resolves: #700157

    [3.2-30]
    - Added man page references to systemwide .bash_logout       Resolves: #592979

    [3.2-29]
    - Readline glitch, when editing line with more spaces and resizing window       Resolves: #525474

    [3.2-28]
    - Fix the memory leak in read builtin       Resolves: #618393
    - Dont append slash to non-directories       Resolves: #583919

    [3.2-27]
    - Test .dynamic section if has PROGBITS or NOBITS       Resolves: #484809
    - Better random number generator       Resolves: #492908
    - Allow to source scripts with embeded NULL chars       Resolves: #503701

    [3.2-26]
    - vi mode redo insert fixed       Resolves: #575076
    - Dont show broken pipe messages for builtins       Resolves: #546529
    - Dont include loadables in doc dir       Resolves: #663656
    - Enable system-wide .bash_logout for login shells       Resolves: #592979

    [3.2-25]
    - Dont abort source builtin       Resolves: #448508
    - Correctly place cursor       Resolves: #463880
    - Minor man page clarification for trap builtin       Resolves: #504904

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2011:0261 :

Updated bash packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Bash (Bourne-again shell) is the default shell for Red Hat Enterprise Linux.

It was found that certain scripts bundled with the Bash documentation created temporary files in an insecure way. A malicious, local user could use this flaw to conduct a symbolic link attack, allowing them to overwrite the contents of arbitrary files accessible to the victim running the scripts. (CVE-2008-5374)

This update also fixes the following bugs :

* If a child process's PID was the same as the PID of a previously ended child process, Bash did not wait for that child process. In some cases this caused 'Resource temporarily unavailable' errors. With this update, Bash recycles PIDs and waits for processes with recycled PIDs.
(BZ#521134)

* Bash's built-in 'read' command had a memory leak when 'read' failed due to no input (pipe for stdin). With this update, the memory is correctly freed. (BZ#537029)

* Bash did not correctly check for a valid multi-byte string when setting the IFS value, causing Bash to crash. With this update, Bash checks the multi-byte string and no longer crashes. (BZ#539536)

* Bash incorrectly set locale settings when using the built-in 'export' command and setting the locale on the same line (for example, with 'LC_ALL=C export LC_ALL'). With this update, Bash correctly sets locale settings. (BZ#539538)

All bash users should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote host is affected by the vulnerability described in GLSA-201210-05 (Bash: Multiple vulnerabilities)

    Two vulnerabilities have been found in Bash:
      Bash example scripts do not handle temporary files securely         (CVE-2008-5374).
      Improper bounds checking in Bash could cause a stack-based buffer         overflow (CVE-2012-3410).
  Impact :

    A remote attacker could entice a user to open a specially crafted Bash       script, possibly resulting in execution of arbitrary code with the       privileges of the process, or a Denial of Service condition of the Bash       executable.
    A local attacker may be able to perform symlink attacks to overwrite       arbitrary files with the privileges of the user running the application       or bypass shell access restrictions.
  Workaround :

    There is no known workaround at this time.

Bash is the default shell for Scientific Linux.

It was found that certain scripts bundled with the Bash documentation created temporary files in an insecure way. A malicious, local user could use this flaw to conduct a symbolic link attack, allowing them to overwrite the contents of arbitrary files accessible to the victim running the scripts. (CVE-2008-5374)

This update fixes the following bugs :

  - When using the source builtin at location '.',     occasionally, bash opted to preserve internal     consistency and abort scripts. This caused bash to abort     scripts that assigned values to read-only variables.
    This is now fixed to ensure that such scripts are now     executed as written and not aborted.

  - When the tab key was pressed for auto-completion options     for the typed text, the cursor moved to an unexpected     position on a previous line if the prompt contained     characters that cannot be viewed and a '\]'. This is now     fixed to retain the cursor at the expected position at     the end of the target line after autocomplete options     correctly display.

  - Bash attempted to interpret the NOBITS .dynamic section     of the ELF header. This resulted in a '^D: bad ELF     interpreter: No such file or directory' message. This is     fixed to ensure that the invalid '^D' does not appear in     the error message.

  - The $RANDOM variable in Bash carried over values from a     previous execution for later jobs. This is fixed and the     $RANDOM variable generates a new random number for each     use.

  - When Bash ran a shell script with an embedded null     character, bash's source builtin parsed the script     incorrectly. This is fixed and bash's source builtin     correctly parses shell script null characters.

  - The bash manual page for 'trap' did not mention that     signals ignored upon entry cannot be listed later. The     manual page was updated for this update and now     specifically notes that 'Signals ignored upon entry to     the shell cannot be trapped, reset or listed'.

  - Bash's readline incorrectly displayed additional text     when resizing the terminal window when text spanned more     than one line, which caused incorrect display output.
    This is now fixed to ensure that text in more than one     line in a resized window displays as expected.

  - Previously, bash incorrectly displayed 'Broken pipe'     messages for builtins like 'echo' and 'printf' when     output did not succeed due to EPIPE. This is fixed to     ensure that the unnecessary 'Broken pipe' messages no     longer display.

  - Inserts with the repeat function were not possible after     a deletion in vi-mode. This has been corrected and, with     this update, the repeat function works as expected after     a deletion.

  - In some situations, bash incorrectly appended '/' to     files instead of just directories during tab-completion,     causing incorrect auto-completions. This is fixed and     auto-complete appends '/' only to directories.

  - Bash had a memory leak in the 'read' builtin when the     number of fields being read was not equal to the number     of variables passed as arguments, causing a shell script     crash. This is fixed to prevent a memory leak and shell     script crash.

  - /usr/share/doc/bash-3.2/loadables in the bash package     contained source files which would not build due to     missing C header files. With this update, the unusable     (and unbuildable) source files were removed from the     package.

This update also adds the following enhancement :

  - The system-wide '/etc/bash.bash_logout' bash logout file     is now enabled. This allows administrators to write     system-wide logout actions for all users.

Users of bash are advised to upgrade to this updated package, which contains backported patches to resolve these issues and add this enhancement.

It was found that certain scripts bundled with the Bash documentation created temporary files in an insecure way. A malicious, local user could use this flaw to conduct a symbolic link attack, allowing them to overwrite the contents of arbitrary files accessible to the victim running the scripts. (CVE-2008-5374)

This update also fixes the following bugs :

  - If a child process's PID was the same as the PID of a     previously ended child process, Bash did not wait for     that child process. In some cases this caused 'Resource     temporarily unavailable' errors. With this update, Bash     recycles PIDs and waits for processes with recycled     PIDs. (BZ#521134)

  - Bash's built-in 'read' command had a memory leak when     'read' failed due to no input (pipe for stdin). With     this update, the memory is correctly freed. (BZ#537029)

  - Bash did not correctly check for a valid multi-byte     string when setting the IFS value, causing Bash to     crash. With this update, Bash checks the multi-byte     string and no longer crashes. (BZ#539536)

  - Bash incorrectly set locale settings when using the     built-in 'export' command and setting the locale on the     same line (for example, with 'LC_ALL=C export LC_ALL').
    With this update, Bash correctly sets locale settings.
    (BZ#539538)

An updated bash package that fixes one security issue, several bugs, and adds one enhancement is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Bash is the default shell for Red Hat Enterprise Linux.

It was found that certain scripts bundled with the Bash documentation created temporary files in an insecure way. A malicious, local user could use this flaw to conduct a symbolic link attack, allowing them to overwrite the contents of arbitrary files accessible to the victim running the scripts. (CVE-2008-5374)

This update fixes the following bugs :

* When using the source builtin at location '.', occasionally, bash opted to preserve internal consistency and abort scripts. This caused bash to abort scripts that assigned values to read-only variables.
This is now fixed to ensure that such scripts are now executed as written and not aborted. (BZ#448508)

* When the tab key was pressed for auto-completion options for the typed text, the cursor moved to an unexpected position on a previous line if the prompt contained characters that cannot be viewed and a '\]'. This is now fixed to retain the cursor at the expected position at the end of the target line after autocomplete options correctly display. (BZ#463880)

* Bash attempted to interpret the NOBITS .dynamic section of the ELF header. This resulted in a '^D: bad ELF interpreter: No such file or directory' message. This is fixed to ensure that the invalid '^D' does not appear in the error message. (BZ#484809)

* The $RANDOM variable in Bash carried over values from a previous execution for later jobs. This is fixed and the $RANDOM variable generates a new random number for each use. (BZ#492908)

* When Bash ran a shell script with an embedded null character, bash's source builtin parsed the script incorrectly. This is fixed and bash's source builtin correctly parses shell script null characters.
(BZ#503701)

* The bash manual page for 'trap' did not mention that signals ignored upon entry cannot be listed later. The manual page was updated for this update and now specifically notes that 'Signals ignored upon entry to the shell cannot be trapped, reset or listed'. (BZ#504904)

* Bash's readline incorrectly displayed additional text when resizing the terminal window when text spanned more than one line, which caused incorrect display output. This is now fixed to ensure that text in more than one line in a resized window displays as expected.
(BZ#525474)

* Previously, bash incorrectly displayed 'Broken pipe' messages for builtins like 'echo' and 'printf' when output did not succeed due to EPIPE. This is fixed to ensure that the unnecessary 'Broken pipe' messages no longer display. (BZ#546529)

* Inserts with the repeat function were not possible after a deletion in vi-mode. This has been corrected and, with this update, the repeat function works as expected after a deletion. (BZ#575076)

* In some situations, bash incorrectly appended '/' to files instead of just directories during tab-completion, causing incorrect auto-completions. This is fixed and auto-complete appends '/' only to directories. (BZ#583919)

* Bash had a memory leak in the 'read' builtin when the number of fields being read was not equal to the number of variables passed as arguments, causing a shell script crash. This is fixed to prevent a memory leak and shell script crash. (BZ#618393)

* /usr/share/doc/bash-3.2/loadables in the bash package contained source files which would not build due to missing C header files. With this update, the unusable (and unbuildable) source files were removed from the package. (BZ#663656)

This update also adds the following enhancement :

* The system-wide '/etc/bash.bash_logout' bash logout file is now enabled. This allows administrators to write system-wide logout actions for all users. (BZ#592979)

Users of bash are advised to upgrade to this updated package, which contains backported patches to resolve these issues and add this enhancement.

Updated bash packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Bash (Bourne-again shell) is the default shell for Red Hat Enterprise Linux.

It was found that certain scripts bundled with the Bash documentation created temporary files in an insecure way. A malicious, local user could use this flaw to conduct a symbolic link attack, allowing them to overwrite the contents of arbitrary files accessible to the victim running the scripts. (CVE-2008-5374)

This update also fixes the following bugs :

* If a child process's PID was the same as the PID of a previously ended child process, Bash did not wait for that child process. In some cases this caused 'Resource temporarily unavailable' errors. With this update, Bash recycles PIDs and waits for processes with recycled PIDs.
(BZ#521134)

* Bash's built-in 'read' command had a memory leak when 'read' failed due to no input (pipe for stdin). With this update, the memory is correctly freed. (BZ#537029)

* Bash did not correctly check for a valid multi-byte string when setting the IFS value, causing Bash to crash. With this update, Bash checks the multi-byte string and no longer crashes. (BZ#539536)

* Bash incorrectly set locale settings when using the built-in 'export' command and setting the locale on the same line (for example, with 'LC_ALL=C export LC_ALL'). With this update, Bash correctly sets locale settings. (BZ#539538)

All bash users should upgrade to these updated packages, which contain backported patches to correct these issues.

A vulnerability have been discovered in Mandriva bash package, which could allow a malicious user to hide files from the ls command, or garble its output by crafting files or directories which contain special characters or escape sequences (CVE-2010-0002). This update fixes the issue by disabling the display of control characters by default.

Additionally, this update fixes the unsafe file creation in bash-doc sample scripts (CVE-2008-5374).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

ID	Name	Product	Family	Severity
181038	Oracle Linux 5 : bash (ELSA-2011-1073)	Nessus	Oracle Linux Local Security Checks	medium
68202	Oracle Linux 4 : bash (ELSA-2011-0261)	Nessus	Oracle Linux Local Security Checks	medium
62650	GLSA-201210-05 : Bash: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
61088	Scientific Linux Security Update : bash on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60956	Scientific Linux Security Update : bash on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
56266	CentOS 5 : bash (CESA-2011:1073)	Nessus	CentOS Local Security Checks	medium
55646	RHEL 5 : bash (RHSA-2011:1073)	Nessus	Red Hat Local Security Checks	medium
52008	RHEL 4 : bash (RHSA-2011:0261)	Nessus	Red Hat Local Security Checks	medium
43880	Mandriva Linux Security Advisory : bash (MDVSA-2010:004)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2008-5374

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium