Debian DSA-3032-1 : bash - security update

Critical Nessus Plugin ID 77825

Synopsis

The remote Debian host is missing a security-related update.

Description

Stephane Chazelas discovered a vulnerability in bash, the GNU Bourne-Again Shell, related to how environment variables are processed. In many common configurations, this vulnerability is exploitable over the network, especially if bash has been configured as the system shell.

Solution

Upgrade the bash packages.

For the stable distribution (wheezy), this problem has been fixed in version 4.2+dfsg-0.1+deb7u1.

See Also

http://www.debian.org/security/2014/dsa-3032

Plugin Details

Severity: Critical

ID: 77825

File Name: debian_DSA-3032.nasl

Version: 1.6

Type: local

Agent: unix

Published: 2014/09/25

Updated: 2020/03/12

Dependencies: 12634

Risk Information

Risk Factor: Critical

CVSS v2.0

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:bash, cpe:/o:debian:debian_linux:7.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2014/09/24

Exploitable With

Core Impact

Metasploit (Apache mod_cgi Bash Environment Variable Code Injection (Shellshock))

Reference Information

CVE: CVE-2014-6271

DSA: 3032

IAVA: 2014-A-0142