REDHAT-BUG-1377613
First published: Tue Sep 20 2016(Updated: )
A vulnerability was found in a way bash expands the $HOSTNAME. Injecting the hostname with malicious code would cause it to run each time bash expanded \h in the prompt string. References: <a href="http://seclists.org/oss-sec/2016/q3/528">http://seclists.org/oss-sec/2016/q3/528</a> Ubuntu bug: <a href="https://bugs.launchpad.net/ubuntu/+source/bash/+bug/1507025">https://bugs.launchpad.net/ubuntu/+source/bash/+bug/1507025</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNU Bash |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://seclists.org/oss-sec/2016/q3/528
- https://bugs.launchpad.net/ubuntu/+source/bash/+bug/1507025
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1377614
- http://openwall.com/lists/oss-security/2016/09/16/18
- http://seclists.org/oss-sec/2016/q3/538
- https://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-047
- https://rhn.redhat.com/errata/RHSA-2017-0725.html
- https://access.redhat.com/errata/RHSA-2017:1931
- https://bugzilla.redhat.com/show_bug.cgi?id=1377613
Frequently Asked Questions
What is the severity of REDHAT-BUG-1377613?
The vulnerability REDHAT-BUG-1377613 is considered to be of medium severity as it allows the execution of arbitrary code through a compromised hostname.
How do I fix REDHAT-BUG-1377613?
To fix REDHAT-BUG-1377613, update your GNU Bash to the latest patched version provided by your distribution.
What are the potential risks of REDHAT-BUG-1377613?
The potential risks of REDHAT-BUG-1377613 include unauthorized code execution and possible system compromises if an attacker is able to manipulate the hostname.
Which versions of Bash are affected by REDHAT-BUG-1377613?
REDHAT-BUG-1377613 affects particular versions of GNU Bash but specific version numbers should be checked in the security advisories for your distribution.
How can I identify if REDHAT-BUG-1377613 is present in my system?
To identify if REDHAT-BUG-1377613 is present in your system, review your Bash configuration for any unusual hostname settings or conduct a security scan.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-0634
- agent/source
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gnu
- canonical/gnu bash