16

A mechanism for remote code execution through Bash has been widely reported yesterday and today (September 24, 2014.) http://seclists.org/oss-sec/2014/q3/650 Reported as CVE-2014-7169 or CVE-2014-6271

For reasons too stupid for me to explain in public, I am responsible for a server running RHEL 4 and with no update subscription. I could build a clone to test this, but I hope someone will have a direct answer.

  1. Has /bin/bash from Centos 4 been patched, or will it be?
  2. Can I just plop a (presumably patched) Centos 4 /bin/bash into my RHEL system as a workaround that will buy me several weeks? (I need until December 10)
  • I'd upvote your question if having to ask it weren't so cringe-worthy. – mc0e Sep 28 '14 at 8:48
  • 1
    Well, I am in a cringe-worthy position. – Bob Brown Sep 28 '14 at 8:57
  • Apparently. It happens. – mc0e Sep 28 '14 at 9:38
21

A patch has been provided by Oracle for el4 :

https://oss.oracle.com/el4/SRPMS-updates/bash-3.0-27.0.1.el4.src.rpm

https://oss.oracle.com/el4/SRPMS-updates/bash-3.0-27.0.2.el4.src.rpm

https://oss.oracle.com/el4/SRPMS-updates/bash-3.0-27.0.3.el4.src.rpm

https://oss.oracle.com/el4/SRPMS-updates/bash-3.0-27.el4.src.rpm

As it is a src RPM, you need to compile then rpmbuild.

or use this link to avoid the build

http://public-yum.oracle.com/repo/EnterpriseLinux/EL4/latest/i386/getPackage/bash-3.0-27.0.1.el4.i386.rpm

http://public-yum.oracle.com/repo/EnterpriseLinux/EL4/latest/i386/getPackage/bash-3.0-27.0.3.el4.i386.rpm

I tested it on a 4.9 i386 system, passed the exploit test I have. (Ted)

20

I had to patch an old CentOS 4.9 server, so I pulled the latest source RPM from the Red Hat FTP and added the upstream patch from the GNU FTP. The steps are below:

First, follow the "Setup" procedure from http://bradthemad.org/tech/notes/patching_rpms.php.

Then run the following commands from your %_topdir:

wget http://ftp.redhat.com/redhat/linux/updates/enterprise/4ES/en/os/SRPMS/bash-3.0-27.el4.src.rpm
rpm -ivh bash-3.0-27.el4.src.rpm
cd SOURCES
wget http://ftp.gnu.org/gnu/bash/bash-3.0-patches/bash30-017
cd ..

Patch SPECS/bash.spec with this diff:

4c4
< Release: 27%{?dist}
---
> Release: 27.2%{?dist}
28a29
> Patch17: bash30-017
110c111,112
< #%patch16 -p0 -b .016
---
> %patch16 -p0 -b .016
> %patch17 -p0 -b .017

Then finish with these commands:

rpmbuild -ba SPECS/bash.spec
sudo rpm -Uvh RPMS/i386/bash-3.0-27.2.i386.rpm

If someone knows an easy way to upload them, I'll put up my source and RPM.

Edit: The latest comments in the Red Hat Bugzilla say the patch is incomplete. The new ID is CVE-2014-7169.

Edit: There are two additional patches from gnu.org, so also download those into the same SOURCES directory:

wget http://ftp.gnu.org/gnu/bash/bash-3.0-patches/bash30-018
wget http://ftp.gnu.org/gnu/bash/bash-3.0-patches/bash30-019

Then also edit the SPECS/bash.spec as follows ("Release" numbering optional):

4c4
< Release: 27%{?dist}
---
> Release: 27.2.019%{?dist}
28a29,31
> Patch17: bash30-017
> Patch18: bash30-018
> Patch19: bash30-019
110c113,116
< #%patch16 -p0 -b .016
---
> %patch16 -p0 -b .016
> %patch17 -p0 -b .017
> %patch18 -p0 -b .018
> %patch19 -p0 -b .019
  • 1
    +1 for the step by step, lest we forget how to do this stuff. – Steve Kehlet Sep 26 '14 at 21:38
14

RHEL 4 is in it's "extended life" phase and security updates will be only available to paying customers. CentOS 4 is out of support since March 2012. No further updates are available for this since this time.

Your only options are to

  • Buy a support contract with RedHat
  • Try to build your own package for Bash.
  • Or the winning option: Retire this machine and use this security issue as an incentive to do so.
  • 4
    Thank you. Because I used my real name here, I cannot explain in public why I can't retire the machine before December 10. Ditto with why it's three versions back with no contract. I've upvoted your answer, and thanks. I'll accept it if no one comes up with a rescue pretty soon. – Bob Brown Sep 25 '14 at 2:25
  • 2
    @BobBrown What? You've actually used the fictional name I use for my administrative accounts. Weird. – HopelessN00b Sep 25 '14 at 18:39
  • 6
    I blame my parents. – Bob Brown Sep 25 '14 at 19:08
2

A kind soul named Lewis Rosenthal has placed updated Bash RPMS for CentOS 4 up on his FTP server. The bash-3.0-27.3 RPM is believed to address CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187. He has a README with more information, and there was some discussion on the CentOS forums. Don't forget this helpful all-in-one check script--note that the CVE-2014-7186 check will fail with a segmentation fault, but it's still believed to be okay, because some other tests for that vulnerability turn up okay.

I would say, either follow @tstaylor7's instructions to build your own patched RPM from source or install the above. When I tried, they both had the same results in that check script.

protected by Chris S Sep 25 '14 at 17:13

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.