A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the "echo -e" built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv().

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - bash: when effective UID is not equal to its real UID the saved UID is not dropped (CVE-2019-18276)

  - A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the     current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function. A     local attacker, who can provide data to print through the echo -e built-in function, may use this flaw     to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr()     in lib/sh/strtrans.c mishandles u32cconv(). (CVE-2012-6711)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function.
A local attacker, who can provide data to print through the 'echo -e' built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv(). (CVE-2012-6711)

Impact

A local attacker can perform a buffer-overflow attack, which can lead to data corruption, allow the malicious code to be run, or cause the program to terminate.

According to the version of the bash package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A heap-based buffer overflow exists in GNU Bash before     4.3 when wide characters, not supported by the current     locale set in the LC_CTYPE environment variable, are     printed through the echo built-in function. A local     attacker, who can provide data to print through the     'echo -e' built-in function, may use this flaw to crash     a script or execute code with the privileges of the     bash process. This occurs because ansicstr() in     lib/sh/strtrans.c mishandles u32cconv().(CVE-2012-6711)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bash fixes the following issues :

CVE-2012-6711: Fixed a heap-based buffer overflow during echo of unsupported characters (bsc#1138676).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the bash package has been released.

According to the version of the bash package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A heap-based buffer overflow was discovered in bash     when wide characters, not supported by the current     locale set in LC_CTYPE environment variable, are     printed through the echo built-in function. A local     attacker, who can provide data to print through the     `echo -e` built-in function, may use this flaw to crash     a script or execute code with the privileges of the     bash process.(CVE-2012-6711)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the bash package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A heap-based buffer overflow was discovered in bash     when wide characters, not supported by the current     locale set in LC_CTYPE environment variable, are     printed through the echo built-in function. A local     attacker, who can provide data to print through the     `echo -e` built-in function, may use this flaw to crash     a script or execute code with the privileges of the     bash process.(CVE-2012-6711)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198803	RHEL 7 : bash (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
159629	F5 Networks BIG-IP : Bash vulnerability (K05122252)	Nessus	F5 Networks Local Security Checks	high
149116	EulerOS 2.0 SP3 : bash (EulerOS-SA-2021-1765)	Nessus	Huawei Local Security Checks	high
137480	EulerOS 2.0 SP2 : bash (EulerOS-SA-2020-1638)	Nessus	Huawei Local Security Checks	high
131071	SUSE SLES12 Security Update : bash (SUSE-SU-2019:2976-1)	Nessus	SuSE Local Security Checks	high
129783	Photon OS 1.0: Bash PHSA-2019-1.0-0252	Nessus	PhotonOS Local Security Checks	high
129681	Photon OS 1.0: Bash PHSA-2019-1.0-0255	Nessus	PhotonOS Local Security Checks	high
128945	EulerOS Virtualization for ARM 64 3.0.2.0 : bash (EulerOS-SA-2019-1942)	Nessus	Huawei Local Security Checks	high
128834	EulerOS 2.0 SP5 : bash (EulerOS-SA-2019-1911)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2012-6711

high

Tenable Plugins

high

high

high

high

high

high

high

high

high