Bug 19808 - bash new security issue CVE-2016-9401
Summary: bash new security issue CVE-2016-9401
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: https://lwn.net/Vulnerabilities/710484/
Whiteboard: MGA5-64-OK MGA5-32-OK has_procedure a...
Keywords: validated_update
Depends on: 19462
Blocks:
  Show dependency treegraph
 
Reported: 2016-11-18 00:32 CET by David Walser
Modified: 2017-01-06 09:29 CET (History)
5 users (show)

See Also:
Source RPM: bash-4.3-33.1.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2016-11-18 00:32:19 CET
A CVE has been assigned for a security issue in bash:
http://openwall.com/lists/oss-security/2016/11/17/9

I don't know if a fix is available yet.
David Walser 2016-11-18 00:32:30 CET

Depends on: (none) => 19462
Whiteboard: (none) => MGA5TOO

Comment 1 Nicolas Lécureuil 2016-11-18 01:31:32 CET
no fix is available yet.

CC: (none) => mageia

Comment 2 Marja Van Waes 2016-11-18 10:06:33 CET
(In reply to Nicolas Lécureuil from comment #1)
> no fix is available yet.

Already assigning to the maintainer, though

CC: (none) => marja11
Assignee: bugsquad => shlomif

Shlomi Fish 2016-12-24 21:07:04 CET

Status: NEW => ASSIGNED

Comment 3 David Walser 2017-01-03 20:39:33 CET
Gentoo has issued an advisory for this on January 1:
https://security.gentoo.org/glsa/201701-02

They added this patch:
https://gitweb.gentoo.org/repo/gentoo.git/plain/app-shells/bash/files/bash-4.4-popd-offset-overflow.patch?id=1bf1ceeb04a2f57e1e5e1636a8c288c4d0db6682

URL: (none) => https://lwn.net/Vulnerabilities/710484/

Comment 4 Shlomi Fish 2017-01-03 22:23:55 CET
(In reply to David Walser from comment #3)
> Gentoo has issued an advisory for this on January 1:
> https://security.gentoo.org/glsa/201701-02
> 
> They added this patch:
> https://gitweb.gentoo.org/repo/gentoo.git/plain/app-shells/bash/files/bash-4.
> 4-popd-offset-overflow.patch?id=1bf1ceeb04a2f57e1e5e1636a8c288c4d0db6682

Thanks, David!

I updated it in Cauldron in bash-4.3-48.3 which is currently scheduled for building at http://pkgsubmit.mageia.org/ and I'm going to tackle mga v5 next.
Comment 5 Shlomi Fish 2017-01-03 23:55:08 CET
(In reply to Shlomi Fish from comment #4)
> (In reply to David Walser from comment #3)
> > Gentoo has issued an advisory for this on January 1:
> > https://security.gentoo.org/glsa/201701-02
> > 
> > They added this patch:
> > https://gitweb.gentoo.org/repo/gentoo.git/plain/app-shells/bash/files/bash-4.
> > 4-popd-offset-overflow.patch?id=1bf1ceeb04a2f57e1e5e1636a8c288c4d0db6682
> 
> Thanks, David!
> 
> I updated it in Cauldron in bash-4.3-48.3 which is currently scheduled for
> building at http://pkgsubmit.mageia.org/ and I'm going to tackle mga v5 next.

bash update 4.3-48.2.1 was pushed to mgav5 core/updates_testing. Someone needs to prepare an advisory.

Version: Cauldron => 5
Assignee: shlomif => qa-bugs
Whiteboard: MGA5TOO => (none)

Comment 6 David Walser 2017-01-04 00:10:30 CET
Advisory:
========================

Updated bash packages fix security vulnerability:

In Bash, the popd command can be tricked to free a user supplied address, which
could be used to bypass restricted shells (rsh) on some environments to cause
use-after-free (CVE-2016-9401).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9401
http://openwall.com/lists/oss-security/2016/11/17/9
https://security.gentoo.org/glsa/201701-02
Comment 7 Len Lawrence 2017-01-04 18:37:38 CET
Tested on x86_64.

Tried the command posted at http://openwall.com/lists/oss-security/2016/11/17/9
$ popd +-111111
Segmentation fault

Updated bash from core updates testing and tried again:
$ popd +-111111
bash: popd: directory stack empty

Probably safe to assume that this means that the patch is successful.

CC: (none) => tarazed25

Len Lawrence 2017-01-04 19:17:00 CET

Whiteboard: (none) => MGA5-64-OK

Comment 8 Len Lawrence 2017-01-04 19:19:04 CET
Ran the popd test on i586 virtualbox before and after the bash update and found the same results as for 64-bits.  This can be validated.
Len Lawrence 2017-01-04 19:19:37 CET

Keywords: (none) => validated_update
Whiteboard: MGA5-64-OK => MGA5-64-OK MGA5-32-OK
CC: (none) => sysadmin-bugs

Len Lawrence 2017-01-04 19:21:57 CET

Whiteboard: MGA5-64-OK MGA5-32-OK => MGA5-64-OK MGA5-32-OK has_procedure

Comment 9 Lewis Smith 2017-01-05 22:14:10 CET
Advisoried from comments 5 & 6.

CC: (none) => lewyssmith
Whiteboard: MGA5-64-OK MGA5-32-OK has_procedure => MGA5-64-OK MGA5-32-OK has_procedure advisory

Comment 10 Mageia Robot 2017-01-06 09:29:05 CET
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2017-0005.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.