Vulnerability in bash package (Debian:7)
Summary
DLA-680-2: bash - version number correction. Affects bash versions < 4.2+dfsg-0.1+deb7u4. Fixed in 4.2+dfsg-0.1+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bash package is a sh-compatible command language interpreter used as the default shell in Debian. It provides a wide range of functionality for executing commands, scripting, and managing system processes. However, a vulnerability has been discovered in bash that can lead to root privilege escalation when combined with insecure setuid binaries.
Vulnerability Detail
The vulnerability, identified as CVE-2016-7543, occurs when specially crafted SHELLOPTS+PS4 environment variables are used in combination with insecure setuid binaries. This combination allows an attacker to gain root access by exploiting the setuid() function call in conjunction with a system() or popen() function call. It is important to note that the system must have bash set as the default shell (/bin/sh points to bash) for this vulnerability to be exploitable. However, Debian 7 (Wheezy) uses dash as the default shell, and there are no known setuid binaries in Debian with this insecure combination. Local software with this insecure combination may still be vulnerable.
How To Fix
Minimum fixed version
4.2+dfsg-0.1+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade bashTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in the bash package (Debian:7) allows for root privilege escalation when combined with insecure setuid binaries. However, Debian 7 (Wheezy) uses dash as the default shell, which mitigates this specific vulnerability. It is recommended to keep the bash package updated and address any insecure setuid binaries separately. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bash →
FAQ
The vulnerability allows an attacker to escalate their privileges to root, potentially gaining full control over the system.
Debian 7 (Wheezy) uses dash as the default shell, which is not vulnerable to this specific issue. However, local software with the insecure combination of setuid() and system() or popen() calls may still be vulnerable.
No, there are no known setuid binaries in Debian with the insecure combination of setuid() and system() or popen() calls.
No, this vulnerability requires local access to the system and the presence of a setuid binary with the insecure combination.
If you have local software with the insecure combination of setuid() and system() or popen() calls, the bash update will not fix the problem. You should address the issue in the insecure setuid binary itself.
Related vulnerabilities
Recent vulnerabilities recorded for bash.
