Stack-based buffer overflow in lib/sh/eaccess.c in GNU Bash before 4.2 patch 33 might allow local users to bypass intended restricted shell access via a long filename in /dev/fd, which is not properly handled when expanding the /dev/fd prefix.

The remote Solaris system is missing necessary patches to address security updates :

  - Stack-based buffer overflow in lib/sh/eaccess.c in GNU     Bash before 4.2 patch 33 might allow local users to     bypass intended restricted shell access via a long     filename in /dev/fd, which is not properly handled when     expanding the /dev/fd prefix. (CVE-2012-3410)

Bash was fixed to avoid a possible buffer overflow when expanding the /dev/fd prefix with e.g. the test builtin (bnc#770795) (CVE-2012-3410)

Due to _FORTIFY_SOURCE=2 enablement, the exploit will only abort the shell.

A vulnerability was found and corrected in bash :

A stack-based buffer overflow flaw was found in the way bash, the GNU Bourne Again shell, expanded certain /dev/fd file names when checking file names ('test' command) and evaluating /dev/fd file names in conditinal command expressions. A remote attacker could provide a specially crafted Bash script that, when executed, would cause the bash executable to crash (CVE-2012-3410).

Additionally the official patches 011 to 037 for bash-4.2 has been applied which resolves other issues found, including the CVE-2012-3410 vulnerability.

NOTE: This advisory was previousely given the MDVSA-2013:019 identifier by mistake.

Parsing the /dev/fd prefix could have lead to a stack-based buffer overflow which could have been exploited by attackers to bypass security restrictions. This has been fixed.

The remote host is affected by the vulnerability described in GLSA-201210-05 (Bash: Multiple vulnerabilities)

    Two vulnerabilities have been found in Bash:
      Bash example scripts do not handle temporary files securely         (CVE-2008-5374).
      Improper bounds checking in Bash could cause a stack-based buffer         overflow (CVE-2012-3410).
  Impact :

    A remote attacker could entice a user to open a specially crafted Bash       script, possibly resulting in execution of arbitrary code with the       privileges of the process, or a Denial of Service condition of the Bash       executable.
    A local attacker may be able to perform symlink attacks to overwrite       arbitrary files with the privileges of the user running the application       or bypass shell access restrictions.
  Workaround :

    There is no known workaround at this time.

A vulnerability was found and corrected in bash :

A stack-based buffer overflow flaw was found in the way bash, the GNU Bourne Again shell, expanded certain /dev/fd file names when checking file names ('test' command) and evaluating /dev/fd file names in conditinal command expressions. A remote attacker could provide a specially crafted Bash script that, when executed, would cause the bash executable to crash (CVE-2012-3410).

Additionally the official patches 011 to 037 for bash-4.2 has been applied which resolves other issues found, including the CVE-2012-3410 vulnerability.

Parsing the /dev/fd prefix could have lead to a stack-based buffer overflow which could have been exploited by attackers to bypass security restrictions. (CVE-2012-3410)

ID	Name	Product	Family	Severity
80591	Oracle Solaris Third-Party Patch Update : bash (cve_2012_3410_stack_based)	Nessus	Solaris Local Security Checks	medium
74685	openSUSE Security Update : bash (openSUSE-SU-2012:0898-1)	Nessus	SuSE Local Security Checks	medium
66046	Mandriva Linux Security Advisory : bash (MDVSA-2013:032)	Nessus	Mandriva Local Security Checks	medium
64110	SuSE 11.1 Security Update : bash (SAT Patch Number 6541)	Nessus	SuSE Local Security Checks	medium
62650	GLSA-201210-05 : Bash: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
61977	Mandriva Linux Security Advisory : bash (MDVSA-2012:128)	Nessus	Mandriva Local Security Checks	medium
61524	SuSE 10 Security Update : bash (ZYPP Patch Number 8217)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2012-3410

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium