Debian DSA-3032-1 : bash - security update

critical Nessus Plugin ID 77825

Language:

Synopsis

The remote Debian host is missing a security-related update.

Description

Stephane Chazelas discovered a vulnerability in bash, the GNU Bourne-Again Shell, related to how environment variables are processed. In many common configurations, this vulnerability is exploitable over the network, especially if bash has been configured as the system shell.

Solution

Upgrade the bash packages.

For the stable distribution (wheezy), this problem has been fixed in version 4.2+dfsg-0.1+deb7u1.

See Also

http://www.debian.org/security/2014/dsa-3032

Plugin Details

Severity: Critical

ID: 77825

File Name: debian_DSA-3032.nasl

Version: 1.8

Type: local

Agent: unix

Published: 9/25/2014

Updated: 1/31/2022

Supported Sensors: Frictionless Assessment Agent, Nessus Agent

Risk Information

VPR

Risk Factor: Critical

Score: 9.5

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:bash, cpe:/o:debian:debian_linux:7.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/24/2014

CISA Known Exploited Dates: 7/28/2022

Exploitable With

Core Impact

Metasploit (Apache mod_cgi Bash Environment Variable Code Injection (Shellshock))

Reference Information

CVE: CVE-2014-6271

DSA: 3032

IAVA: 2014-A-0142