My Favorites

Close

Please to see your favorites.

  • Bookmark
  • Email Document
  • Printer Friendly
  • Favorite
  • Rating:

CVE-2014-6277 and CVE-2014-6278

This document (7015714) is provided subject to the disclaimer at the end of this document.

Environment

  • SUSE Linux Enterprise Server 11 SP2 LTSS
  • SUSE Linux Enterprise Server 11 SP1 LTSS
  • SUSE Linux Enterprise Server 10 SP4 LTSS
  • SUSE Linux Enterprise Server 10 SP3 LTSS
  • SUSE Linux Enterprise Software Development Kit 11 SP3
  • SUSE Linux Enterprise Desktop 11 SP3
  • SUSE Linux Enterprise Server 11 SP3
  • SUSE Linux Enterprise Server 11 SP3 for VMware
  • SLES Expanded Support platform release 6.5
  • SLES Expanded Support platform release 5.10


Situation

SUSE has been made aware of  the following two vulnerabilities:

  • CVE-2014-6278
  • CVE-2014-6277

Both vulnerabilities have been already mitigated within the update previously released for CVE-2014-7169.  With this hardening enabled it is no longer possible for attackers to inject environment variables that are parsed as functions, effectively disabling the whole class of attacks against the bash parser.

In order to detect if your bash version is hardened and therefore not affected, the following test is available:

hello() { echo hello; } ; export -f hello ; env|grep hello

An output like:

hello=() {  echo hello

Indicates a vulnerable version of bash

While:

BASH_FUNC_hello()=() {  echo hello

Indicates a patched bash version

For further details and patches, please refer to
https://support.novell.com/security/cve/CVE-2014-7169.html

Disclaimer

This Support Knowledgebase provides a valuable tool for NetIQ/Novell/SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.

  • Document ID:7015714
  • Creation Date:30-SEP-14
  • Modified Date:01-APR-15
    • SUSESUSE Linux Enterprise Server
< Back to Support Search

SUSE Support Forums

Get your questions answered by experienced Sys Ops or interact with other SUSE community experts.

Join Our Community

Support Resources

Learn how to get the most from the technical support you receive with your SUSE Subscription, Premium Support, Academic Program, or Partner Program.


SUSE Customer Support Quick Reference Guide SUSE Technical Support Handbook Update Advisories
Support FAQ

Open an Incident

Open an incident with SUSE Technical Support, manage your subscriptions, download patches, or manage user access.

Go to Customer Center