CVE-2012-6711: Buffer Overflow
A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LCCTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the "echo -e" built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv().
Other sources
An heap-based buffer overflow was discovered in bash, between versions 4.2 and 4.3, in function lib/sh/strtrans.c:ansicstr() caused by a wrong handling of unsupported characters in u32cconv(). When LCCTYPE locale cannot correctly convert a wide character to a multibyte sequence, through the wctomb() function, u32cconv() returns a negative value that is used to update a pointer to a buffer in ansicstr(), resulting in a write out of the buffer's bounds. A local attacker, who can provide data to print through the echo builtin function, may use this flaw crash a script or execute code with the privileges of the bash process (e.g. escape a restricted bash or elevate privileges if a setuid script is vulnerable).
Upstream Patch: http://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel&id=863d31ae775d56b785dc5b0105b6d251515d81d5 (in particular the changes to the u32cconv() function are relevant for this flaw)
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2012-6711.
What is the severity rating of CVE-2012-6711?
CVE-2012-6711 has a severity rating of 7.8 (high).
What is the affected software for CVE-2012-6711?
The affected software for CVE-2012-6711 includes GNU Bash versions before 4.3, Debian bash versions 5.0-4, 5.1-2+deb11u1, and 5.2.15-2, Ubuntu bash version 4.3-1, GNU Bash versions 4.2 and earlier, and Redhat Enterprise Linux version 7.0.
How can I fix CVE-2012-6711?
To fix CVE-2012-6711, you should update GNU Bash to version 4.3 or later, Debian bash to versions 5.0-4, 5.1-2+deb11u1, or 5.2.15-2, Ubuntu bash to version 4.3-1, or Redhat Enterprise Linux to a version higher than 7.0.
Where can I find more information about CVE-2012-6711?
You can find more information about CVE-2012-6711 at the following references: [1] http://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel&id=863d31ae775d56b785dc5b0105b6d251515d81d5, [2] https://bugzilla.redhat.com/show_bug.cgi?id=1721071, [3] http://www.securityfocus.com/bid/108824.