bash env bug on legacy centos 4.8 system

A 5 star hangout for overworked and underpaid system admins.
_ck_
Posts: 89
Joined: 2012/08/10 23:00:35

Re: bash env bug on legacy centos 4.8 system

Post by _ck_ » 2014/10/04 04:15:08

Oh thank goodness, with #21 it finally fully passed bashcheck

Code: Select all

GNU bash, version 3.00.21(1)-release (i686-redhat-linux-gnu)

Variable function parser pre/suffixed [%%, upstream], bugs not exploitable
Not vulnerable to CVE-2014-6271 (original shellshock)
Not vulnerable to CVE-2014-7169 (taviso bug)
Not vulnerable to CVE-2014-7186 (redir_stack bug)
Test for CVE-2014-7187 not reliable without address sanitizer
Not vulnerable to CVE-2014-6277 (lcamtuf bug #1)
Not vulnerable to CVE-2014-6278 (lcamtuf bug #2)

rsingh
Posts: 1
Joined: 2014/10/06 09:59:00

Re: bash env bug on legacy centos 4.8 system

Post by rsingh » 2014/10/06 10:02:45

Hi Lewis,
You are a star. I have another system and thats running -
# cat /etc/redhat-release
Red Hat Enterprise Linux ES release 4 (Nahant Update 3)

# bash --version
GNU bash, version 3.00.15(1)-release (i386-redhat-linux-gnu)

Is it safe to use the rpm (bash-3.0-27.5.i386.rpm) from your ftp server for the above release?

Many thanks,
RS

LewisR
Posts: 16
Joined: 2014/09/26 04:40:20
Location: New York, USA
Contact:

Re: bash env bug on legacy centos 4.8 system

Post by LewisR » 2014/10/06 14:31:10

rsingh wrote:Hi Lewis,
You are a star. I have another system and thats running -
# cat /etc/redhat-release
Red Hat Enterprise Linux ES release 4 (Nahant Update 3)

# bash --version
GNU bash, version 3.00.15(1)-release (i386-redhat-linux-gnu)

Is it safe to use the rpm (bash-3.0-27.5.i386.rpm) from your ftp server for the above release?
You're too kind. :oops:

My best guess is that my binary packages should be fine, but I'd prefer to have someone more familiar with the differences weigh in on this (I'm a Novell consultant, so I spend most of my time with SuSE; thus my knowledge of the finer points of CentOS vs RHEL has significant gaps). Sorry I don't have a more definitive answer for you!
Lewis
-------------------------------------------------------------
Lewis G Rosenthal, CNA, CLP, CLE, CWTS
Rosenthal & Rosenthal, LLC
-------------------------------------------------------------

_ck_
Posts: 89
Joined: 2012/08/10 23:00:35

Re: bash env bug on legacy centos 4.8 system

Post by _ck_ » 2014/10/07 16:01:33


LewisR
Posts: 16
Joined: 2014/09/26 04:40:20
Location: New York, USA
Contact:

Re: bash env bug on legacy centos 4.8 system

Post by LewisR » 2014/10/07 16:40:23

Ugh...

My cross-compiling setup still isn't up to par, yet, either. No worries; I'll cobble the next round together and get them posted ASAP.

Thanks for the heads-up!
Lewis
-------------------------------------------------------------
Lewis G Rosenthal, CNA, CLP, CLE, CWTS
Rosenthal & Rosenthal, LLC
-------------------------------------------------------------

LewisR
Posts: 16
Joined: 2014/09/26 04:40:20
Location: New York, USA
Contact:

Re: bash env bug on legacy centos 4.8 system

Post by LewisR » 2014/10/07 22:27:27

Fresh binaries available on my ftp server for:
4.8 (includes patch 22) and
3.9 (includes patch 13)

bashcheck has been updated, as well.

The builds for 3.9 (bash 2.05b) throw an error in a different shellshock test, so I would advise doing some more testing on those to be certain it's not just a quirk of the script (bashcheck reports the vulnerability for CVE-2014-7187 is "unexploitable," so I suspect the issue exists but is fairly benign - again, we are patching software which hadn't seen a patch to this bash since 2003 or so; feels like Y2K all over again).

These are still built with the older gcc builds (3.6.6 for the CentOS 4.8 ones and 3.2.3 for the CentOS 3.9 ones).

Hope they continue to be of use.

Cheers
Lewis
-------------------------------------------------------------
Lewis G Rosenthal, CNA, CLP, CLE, CWTS
Rosenthal & Rosenthal, LLC
-------------------------------------------------------------

Rip
Posts: 1
Joined: 2014/10/08 06:21:41

Re: bash env bug on legacy centos 4.8 system

Post by Rip » 2014/10/08 06:24:42

LewisR,

Created an account so I could express my gratitude for the rpm's you created/provided.

Many thanks !

Cheers
Rip.

LewisR
Posts: 16
Joined: 2014/09/26 04:40:20
Location: New York, USA
Contact:

Re: bash env bug on legacy centos 4.8 system

Post by LewisR » 2014/10/08 14:11:15

Rip wrote:LewisR,

Created an account so I could express my gratitude for the rpm's you created/provided.

Many thanks !
You're very welcome, Rip!

Cheers to you, too. ;)
Lewis
-------------------------------------------------------------
Lewis G Rosenthal, CNA, CLP, CLE, CWTS
Rosenthal & Rosenthal, LLC
-------------------------------------------------------------

_ck_
Posts: 89
Joined: 2012/08/10 23:00:35

Re: bash env bug on legacy centos 4.8 system

Post by _ck_ » 2014/10/31 07:49:05

Looks like we might have to manually update wget on 4.x too

User avatar
TrevorH
Forum Moderator
Posts: 26956
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: bash env bug on legacy centos 4.8 system

Post by TrevorH » 2014/10/31 09:07:57

How are those migration plans coming along...
CentOS 5 died in March 2017 - migrate NOW!
CentOS 6 goes EOL sooner rather than later, get upgrading!
Full time Geek, part time moderator. Use the FAQ Luke

Post Reply

Return to “CentOS Social”