==========================================================================
Ubuntu Security Notice USN-2363-1
September 25, 2014
bash vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 14.04 LTS
– Ubuntu 12.04 LTS
– Ubuntu 10.04 LTS
Summary:
Bash allowed bypassing environment restrictions in certain environments.
Software Description:
– bash: GNU Bourne Again SHell
Details:
Tavis Ormandy discovered that the security fix for Bash included in
USN-2362-1 was incomplete. An attacker could use this issue to bypass
certain environment restrictions. (CVE-2014-7169)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
bash 4.3-7ubuntu1.2
Ubuntu 12.04 LTS:
bash 4.2-2ubuntu2.3
Ubuntu 10.04 LTS:
bash 4.1-2ubuntu3.2
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2363-1
CVE-2014-7169
Package Information:
https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.2
https://launchpad.net/ubuntu/+source/bash/4.2-2ubuntu2.3
https://launchpad.net/ubuntu/+source/bash/4.1-2ubuntu3.2
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIcBAEBCgAGBQJUJJipAAoJEGVp2FWnRL6TCYsQAK/Zc4f1oyE/3GeTOCoPsnJ7
CwFQ7yOUTWGrx8A/f36HY963Cr6o8w8u9gMXRutN1cP6ZPltpgfkPmDovrKa4P8b
0QuxZLOrZD+Oci9Rl61eOdriveEXBybUux3As+pZpdbyVlAj4UqvM0wwJzQ0uHXG
BHwgs91iG55tql+XYvZeDcm+W4r1ElQL4cNms+WU6PiGn1ijVYZPEeX6h+ECthQN
0ijn1DVRI10jeDRMKv+cqqWlRudvNiUEJRNVG7l4UTAuSsDw9uQfaPWFOQFyjspO
KshocdA0l1XxPyIqsIdEW+wvjQzno02oWZVmU6e+ihKZz56Ak2iBbRmJSht8V+IG
0T+d0yEnobDOyim5O22cTfgwBs+NLUXQX7pmZx3FqXs9sAoH4QaRcQ2RFc4PE9jV
QiDqFzC6VwFI0YvEoC44HxtzuLGP/hdZpFTeQp5fy4G8XDnv8qs0/+vlZDTTI2uo
Z6SZ5hGSgxndQ5WhA7bdvNCsT4cr0MWJKAFAD4d9FqLAKbNke2zb8nTy5ZDnDKc/
W9Bj4GEkFxRZpxE0wj/UF9ZxJ8k+PMoefDzz7MO0HsF+7sFHGc0x8WBwzhx7WAni
pxWla1uMp1UzQ8C0BzHOun977KQVcUBpYvpWvK69mfWDKo1P78E8Cr5TfP3TlkhF
zbIkAl0Z9Px22fCV2qmO
=swR1
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
==========================================================================
Ubuntu Security Notice USN-2363-2
September 26, 2014
bash vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 14.04 LTS
Summary:
Bash allowed bypassing environment restrictions in certain environments.
Software Description:
– bash: GNU Bourne Again SHell
Details:
USN-2363-1 fixed a vulnerability in Bash. Due to a build issue, the patch
for CVE-2014-7169 didn’t get properly applied in the Ubuntu 14.04 LTS
package. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Tavis Ormandy discovered that the security fix for Bash included in
USN-2362-1 was incomplete. An attacker could use this issue to bypass
certain environment restrictions. (CVE-2014-7169)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
bash 4.3-7ubuntu1.3
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2363-2
http://www.ubuntu.com/usn/usn-2363-1
CVE-2014-7169
Package Information:
https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.3
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIcBAEBCgAGBQJUJNDEAAoJEGVp2FWnRL6ToNQP/1x1F8tUCFqo+E72d1DGkiwe
2IemU8t7SWfQ8DRlHsBIksC+veqbt9sdqEVZN0RBjIXMVZ7BEqLInctOyVjfdy6g
FeYyb2Jc31xrEUEKLdP/U7DIhko6nfuoKeaDrcyDCqdOlhoh5rJsJruxXF3rge4k
MIM66Kx/3eEI8iv52fcDyVdn4+xmKuZrzzn1rz0Z6dSYSiBoDmouIGg+3HK8sWfK
SoY6LuZlYBlYHqPWF+Q2ZlkkilevV3vAwSzk9UjT2yIlVnVsYurTvqTMBOwCoEQb
RuX2bX7K5l6wVRDYp61SnVqPYEoBZKRx33aKyxV2kPgg5LWZwthbgDQMEgpT4tnk
mNeHo1b21c+T20i2gtoY+DpbMHGpqDg4xFv055HMyhxI+vir+7sG/9ixvsw/rDFx
iH/W7bXd431/FouNLAd7bJeUs5+X+aevs3Q0IYx0IdtvhB/T5H/GynYUgWldho+O
fzfZJJaFYoOWFSoNJfUK1ldRuDS/OPHGe7iC3B6Q/Ddec96hM4PspP+D1/OrCL54
9KwKlqFI1UDnqxgKgxa8mpIqeArqijt/X6ZPOW7IUh8H4O3hMMBHll1sY/UlPsm+
D1ofkvTm8Dm6XiAuRSxyauZkOPErSb0uYHnCXrQO+jNepQv7CSx4/Jfh3hqGQ8np
pJYvGkdvS613mSKsTd15
=Ifv0
—–END PGP SIGNATURE—–
—
