Bash Code Injection Vulnerability via Specially Crafted Environment Variables

[Andrew]

Identified in RedHat and Debian

https://www.debian.org/security/2014/dsa-3032

From the RedHat advisory - https://access.redhat.com/articles/1200223

"Diagnostic Steps

To test if your version of Bash is vulnerable to this issue, run the following command:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

If the output of the above command looks as follows:

vulnerable
this is a test"

Confirmed on Ubuntu 14.04 LTS using Bash 4.3-7ubuntu1.1

[Marc Deslauriers (mdeslaur)]

We've fixed this already:

http://www.ubuntu.com/usn/usn-2362-1/