A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function.
A local attacker, who can provide data to print through the 'echo -e' built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv(). (CVE-2012-6711)

Impact

A local attacker can perform a buffer-overflow attack, which can lead to data corruption, allow the malicious code to be run, or cause the program to terminate.

According to the version of the bash package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - A heap-based buffer overflow was discovered in bash     when wide characters, not supported by the current     locale set in LC_CTYPE environment variable, are     printed through the echo built-in function. A local     attacker, who can provide data to print through the     `echo -e` built-in function, may use this flaw to crash     a script or execute code with the privileges of the     bash process.(CVE-2012-6711)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LC_CTYPE 環境変数で設定されている現在のロケールでサポートされていないワイド文字が echo ビルトイン関数を通じて出力されるとき、4.3 より前の GNU Bash にヒープベースのバッファオーバーフローが存在します。
「echo -e」ビルトイン関数を通じて印刷するデータを提供できるローカルの攻撃者が、この欠陥を利用して、bash プロセスの権限でスクリプトをクラッシュさせたり、コードを実行したりする可能性があります。これは、lib/sh/strtrans.c の ansicstr() が u32cconv() を不適切に処理するために発生します。(CVE-2012-6711)

影響

ローカルの攻撃者がバッファオーバーフロー攻撃を実行し、データ破損を引き起こしたり、悪意のあるコードを実行したり、プログラムを終了させたりする可能性があります。

bash用のこの更新プログラムでは、以下の問題が修正されています：

CVE-2012-6711：サポートされていない文字のエコー中のヒープベースのバッファオーバーフローを修正しました（bsc#1138676）。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

在 GNU Bash 4.3 之前版本中，透過 echo 內建函式輸出 LC_CTYPE 環境變數中設定的目前地區不支援的寬字元時，出現堆積型緩衝區溢位。
本機攻擊者若能透過內建函式「echo -e」提供目標列印資料，便有可能利用這個缺陷損毀指令碼，或以 bash 處理程序的權限執行程式碼。導致這個問題的原因是 lib/sh/strtrans.c 中的 ansicstr() 未正確處理 u32cconv()。(CVE-2012-6711)

影響

透過執行緩衝區溢位攻擊，本機攻擊者可能造成資料損毀、允許執行惡意程式碼或導致程式終止。

在 GNU Bash 4.3 更低版本中，当通过 echo 内置函数输出 LC_CTYPE 环境变量中设置的当前区域设置不支持的宽字符时，出现基于堆的缓冲区溢出问题。
如果本地攻击者可通过内置函数“echo -e”提供目标输出数据，则可能会利用此缺陷以 bash 进程的权限造成脚本崩溃或执行代码。发生此问题的原因是 lib/sh/strtrans.c 中的 ansicstr() 不当处理 u32cconv()。(CVE-2012-6711)

影响

本地攻击者可执行缓冲区溢出攻击，从而可能导致数据损坏、允许运行恶意代码或造成程序终止。

An update of the bash package has been released.

According to the version of the bash package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A heap-based buffer overflow exists in GNU Bash before     4.3 when wide characters, not supported by the current     locale set in the LC_CTYPE environment variable, are     printed through the echo built-in function. A local     attacker, who can provide data to print through the     'echo -e' built-in function, may use this flaw to crash     a script or execute code with the privileges of the     bash process. This occurs because ansicstr() in     lib/sh/strtrans.c mishandles u32cconv().(CVE-2012-6711)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - bash: when effective UID is not equal to its real UID the saved UID is not dropped (CVE-2019-18276)

  - A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the     current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function. A     local attacker, who can provide data to print through the echo -e built-in function, may use this flaw     to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr()     in lib/sh/strtrans.c mishandles u32cconv(). (CVE-2012-6711)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for bash fixes the following issues :

CVE-2012-6711: Fixed a heap-based buffer overflow during echo of unsupported characters (bsc#1138676).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the bash package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A heap-based buffer overflow was discovered in bash     when wide characters, not supported by the current     locale set in LC_CTYPE environment variable, are     printed through the echo built-in function. A local     attacker, who can provide data to print through the     `echo -e` built-in function, may use this flaw to crash     a script or execute code with the privileges of the     bash process.(CVE-2012-6711)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
159629	F5 Networks BIG-IP : Bash vulnerability (K05122252)	Nessus	F5 Networks Local Security Checks	2022/4/11	2023/11/2	high
128945	EulerOS Virtualization for ARM 64 3.0.2.0 : bash (EulerOS-SA-2019-1942)	Nessus	Huawei Local Security Checks	2019/9/17	2024/4/25	high
159629	F5 Networks BIG-IP：PHPの脆弱性（K05122252）	Nessus	F5 Networks Local Security Checks	2022/4/11	2023/11/2	high
131071	SUSE SLES12セキュリティ更新プログラム：bash（SUSE-SU-2019:2976-1）	Nessus	SuSE Local Security Checks	2019/11/15	2024/4/11	high
159629	F5 Networks BIG-IP：Bash 弱點 (K05122252)	Nessus	F5 Networks Local Security Checks	2022/4/11	2023/11/2	high
159629	F5 Networks BIG-IP：Bash 漏洞 (K05122252)	Nessus	F5 Networks Local Security Checks	2022/4/11	2023/11/2	high
129681	Photon OS 1.0: Bash PHSA-2019-1.0-0255	Nessus	PhotonOS Local Security Checks	2019/10/7	2019/12/19	high
137480	EulerOS 2.0 SP2 : bash (EulerOS-SA-2020-1638)	Nessus	Huawei Local Security Checks	2020/6/17	2024/3/6	high
198803	RHEL 7 : bash (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	high
129783	Photon OS 1.0: Bash PHSA-2019-1.0-0252	Nessus	PhotonOS Local Security Checks	2019/10/11	2019/12/19	high
131071	SUSE SLES12 Security Update : bash (SUSE-SU-2019:2976-1)	Nessus	SuSE Local Security Checks	2019/11/15	2024/4/11	high
128834	EulerOS 2.0 SP5 : bash (EulerOS-SA-2019-1911)	Nessus	Huawei Local Security Checks	2019/9/16	2024/4/25	high
149116	EulerOS 2.0 SP3 : bash (EulerOS-SA-2021-1765)	Nessus	Huawei Local Security Checks	2021/4/30	2024/1/3	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high