This script is Copyright (C) 2015-2016 Tenable Network Security, Inc.
The remote Mandriva Linux host is missing one or more security
Updated bash packages fix security vulnerability :
A flaw was found in the way Bash evaluated certain specially crafted
environment variables. An attacker could use this flaw to override or
bypass environment restrictions to execute shell commands. Certain
services and applications allow remote unauthenticated attackers to
provide environment variables, allowing them to exploit this issue
This vulnerability can be exposed and exploited through several other
pieces of software and should be considered highly critical. Please
refer to the RedHat Knowledge Base article and blog post for more
It was found that the fix for CVE-2014-6271 was incomplete, and Bash
still allowed certain characters to be injected into other
environments via specially crafted environment variables. An attacker
could potentially use this flaw to override or bypass environment
restrictions to execute shell commands. Certain services and
applications allow remote unauthenticated attackers to provide
environment variables, allowing them to exploit this issue
Bash has been updated to version 4.2 patch level 50, which further
mitigates ShellShock-type vulnerabilities. Two such issues have
already been discovered (CVE-2014-6277, CVE-2014-6278).
See the RedHat article on the backward-incompatible changes introduced
by the latest patch, caused by adding prefixes and suffixes to the
variable names used for exporting functions. Note that the RedHat
article mentions these variable names will have parentheses '()' at
the end of their names, however, the latest upstream patch uses two
percent signs '%%' at the end instead.
Two other unrelated security issues in the parser have also been fixed
in this update (CVE-2014-7186, CVE-2014-7187).
All users and sysadmins are advised to update their bash package
See also :
Update the affected bash and / or bash-doc packages.
Risk factor :
Critical / CVSS Base Score : 10.0
Public Exploit Available : true
Family: Mandriva Local Security Checks
Nessus Plugin ID: 82417 ()
Get Nessus Professional to scan unlimited IPs, run compliance checks & moreBuy Nessus Professional Now