Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 1396383 - (CVE-2016-9401) CVE-2016-9401 bash: popd controlled free
CVE-2016-9401 bash: popd controlled free
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20161117,reported=2...
: Reopened, Security
Depends On: 1396387 1400793 1429838
Blocks: 1386080 1396388
  Show dependency treegraph
 
Reported: 2016-11-18 03:52 EST by Andrej Nemec
Modified: 2018-03-29 18:02 EDT (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A denial of service flaw was found in the way bash handled popd commands. A poorly written shell script could cause bash to crash resulting in a local denial of service limited to a specific bash session.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-11-29 01:09:46 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:0725 normal SHIPPED_LIVE Moderate: bash security and bug fix update 2017-03-21 08:42:42 EDT
Red Hat Product Errata RHSA-2017:1931 normal SHIPPED_LIVE Moderate: bash security and bug fix update 2017-08-01 14:26:59 EDT

  None (edit)
Description Andrej Nemec 2016-11-18 03:52:56 EST
A vulnerability was found in popd. It can be tricked to free a user supplied address in the following way:

$ popd +-111111

This could be used to bypass restricted shells (rsh) on some environments to cause use-after-free.

References:

http://seclists.org/oss-sec/2016/q4/445
Comment 1 Andrej Nemec 2016-11-18 03:55:33 EST
Created bash tracking bugs for this issue:

Affects: fedora-all [bug 1396387]
Comment 19 errata-xmlrpc 2017-03-21 07:14:40 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0725 https://rhn.redhat.com/errata/RHSA-2017-0725.html
Comment 20 errata-xmlrpc 2017-08-01 16:33:20 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:1931 https://access.redhat.com/errata/RHSA-2017:1931

Note You need to log in before you can comment on or make changes to this bug.