Packages
- bash - The GNU Bourne Again SHell
Details
Michal Zalewski discovered that Bash incorrectly handled parsing certain
function definitions. If an attacker were able to create an environment
variable containing a function definition with a very specific name, these
issues could possibly be used to bypass certain environment restrictions
and execute arbitrary code. (CVE-2014-6277, CVE-2014-6278)
Please note that the previous Bash security update, USN-2364-1, includes
a hardening measure that prevents these issues from being used in a
Shellshock attack.
Michal Zalewski discovered that Bash incorrectly handled parsing certain
function definitions. If an attacker were able to create an environment
variable containing a function definition with a very specific name, these
issues could possibly be used to bypass certain environment restrictions
and execute arbitrary code. (CVE-2014-6277, CVE-2014-6278)
Please note that the previous Bash security update, USN-2364-1, includes
a hardening measure that prevents these issues from being used in a
Shellshock attack.
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 14.04 trusty | bash – 4.3-7ubuntu1.5 | ||
| 12.04 precise | bash – 4.2-2ubuntu2.6 | ||
| 10.04 lucid | bash – 4.1-2ubuntu3.5 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.