A mechanism for remote code execution through Bash has been widely reported yesterday and today (September 24, 2014.) http://seclists.org/oss-sec/2014/q3/650 Reported as CVE-2014-7169 or CVE-2014-6271

For reasons too stupid for me to explain in public, I am responsible for a server running RHEL 4 and with no update subscription. I could build a clone to test this, but I hope someone will have a direct answer.

  1. Has /bin/bash from Centos 4 been patched, or will it be?
  2. Can I just plop a (presumably patched) Centos 4 /bin/bash into my RHEL system as a workaround that will buy me several weeks? (I need until December 10)

A patch has been provided by Oracle for el4 :





As it is a src RPM, you need to compile then rpmbuild.

or use this link to avoid the build



I tested it on a 4.9 i386 system, passed the exploit test I have. (Ted)


I had to patch an old CentOS 4.9 server, so I pulled the latest source RPM from the Red Hat FTP and added the upstream patch from the GNU FTP. The steps are below:

First, follow the "Setup" procedure from http://bradthemad.org/tech/notes/patching_rpms.php:

echo "%_topdir    /home/$(whoami)/src/rpm" > ~/.rpmmacros
mkdir -p ~/src/rpm/RPMS/{i386,i486,i586,i686,noarch,athlon}

Then run the following commands from your %_topdir:

cd ~/src/rpm
wget http://ftp.redhat.com/redhat/linux/updates/enterprise/4ES/en/os/SRPMS/bash-3.0-27.el4.src.rpm
rpm -ivh bash-3.0-27.el4.src.rpm
wget http://ftp.gnu.org/gnu/bash/bash-3.0-patches/bash30-017
cd ..

Patch SPECS/bash.spec with this diff:

< Release: 27%{?dist}
> Release: 27.2%{?dist}
> Patch17: bash30-017
< #%patch16 -p0 -b .016
> %patch16 -p0 -b .016
> %patch17 -p0 -b .017

Then finish with these commands:

rpmbuild -ba SPECS/bash.spec
sudo rpm -Uvh RPMS/i386/bash-3.0-27.2.i386.rpm

Edit: The latest comments in the Red Hat Bugzilla say the patch is incomplete. The new ID is CVE-2014-7169.

Edit: There are two additional patches from gnu.org, so also download those into the same SOURCES directory:

wget http://ftp.gnu.org/gnu/bash/bash-3.0-patches/bash30-018
wget http://ftp.gnu.org/gnu/bash/bash-3.0-patches/bash30-019

Then also edit the SPECS/bash.spec as follows ("Release" numbering optional):

< Release: 27%{?dist}
> Release: 27.2.019%{?dist}
> Patch17: bash30-017
> Patch18: bash30-018
> Patch19: bash30-019
< #%patch16 -p0 -b .016
> %patch16 -p0 -b .016
> %patch17 -p0 -b .017
> %patch18 -p0 -b .018
> %patch19 -p0 -b .019
  • 1
    +1 for the step by step, lest we forget how to do this stuff. – Steve Kehlet Sep 26 '14 at 21:38

RHEL 4 is in it's "extended life" phase and security updates will be only available to paying customers. CentOS 4 is out of support since March 2012. No further updates are available for this since this time.

Your only options are to

  • Buy a support contract with RedHat
  • Try to build your own package for Bash.
  • Or the winning option: Retire this machine and use this security issue as an incentive to do so.
  • 4
    Thank you. Because I used my real name here, I cannot explain in public why I can't retire the machine before December 10. Ditto with why it's three versions back with no contract. I've upvoted your answer, and thanks. I'll accept it if no one comes up with a rescue pretty soon. – Bob Brown Sep 25 '14 at 2:25
  • 2
    @BobBrown What? You've actually used the fictional name I use for my administrative accounts. Weird. – HopelessN00b Sep 25 '14 at 18:39
  • 6
    I blame my parents. – Bob Brown Sep 25 '14 at 19:08

A kind soul named Lewis Rosenthal has placed updated Bash RPMS for CentOS 4 up on his FTP server. The bash-3.0-27.3 RPM is believed to address CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187. He has a README with more information, and there was some discussion on the CentOS forums. Don't forget this helpful all-in-one check script--note that the CVE-2014-7186 check will fail with a segmentation fault, but it's still believed to be okay, because some other tests for that vulnerability turn up okay.

I would say, either follow @tstaylor7's instructions to build your own patched RPM from source or install the above. When I tried, they both had the same results in that check script.

Not the answer you're looking for? Browse other questions tagged or ask your own question.