Skip to main content
Esteemed Contributor III
October 17, 2016

Technical Note: [Accelops KB] How to patch Vulnerabilities: CVE-2014-6271, CVE-2014-7169

  • October 17, 2016
  • 0 replies
  • 815 views

Description

 

Vulnerabilities: CVE-2014-6271, CVE-2014-7169

Here is an explanation of how the vulnerability works:
http://seclists.org/oss-sec/2014/q3/650

 

Steps to Test

1 - Please SSH into the Console of AO (Super, Worker, or Collector) as root

2 - Run the following Command:

  • env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

Affected Output

vulnerable
this is a test

Patch Instructions

1 - cd /etc/yum.repos.d

2 - cp ../yum.repos.d.orig/CentOS-* /etc/yum.repos.d/

  • NOTE:  If the above copy command does not work please run the following:
  • ls -l /etc/yum.repos.d/
  • Make sure CentOS-Base.repo is in this directory
  • If the above file is there - Please move forward to step 3

3 - yum update bash -y

4 - Test Again:  env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

 

Expected results

bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'

this is a test

 

NOTE: Latest Bash patch will have the following result only:

this is a test

 
Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT