Synopsis

Low: bash security, bug fix, and enhancement update

Type/Severity

Security Advisory: Low

Topic

An updated bash package that fixes one security issue, several bugs, and
adds one enhancement is now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Bash is the default shell for Red Hat Enterprise Linux.

It was found that certain scripts bundled with the Bash documentation
created temporary files in an insecure way. A malicious, local user could
use this flaw to conduct a symbolic link attack, allowing them to overwrite
the contents of arbitrary files accessible to the victim running the
scripts. (CVE-2008-5374)

This update fixes the following bugs:

• When using the source builtin at location ".", occasionally, bash
  opted to preserve internal consistency and abort scripts. This caused
  bash to abort scripts that assigned values to read-only variables.
  This is now fixed to ensure that such scripts are now executed as
  written and not aborted. (BZ#448508)
  
• When the tab key was pressed for auto-completion options for the typed
  text, the cursor moved to an unexpected position on a previous line if
  the prompt contained characters that cannot be viewed and a "\]". This
  is now fixed to retain the cursor at the expected position at the end of
  the target line after autocomplete options correctly display. (BZ#463880)
  
• Bash attempted to interpret the NOBITS .dynamic section of the ELF
  header. This resulted in a "^D: bad ELF interpreter: No such
  file or directory" message. This is fixed to ensure that the invalid
  "^D" does not appear in the error message. (BZ#484809)
  
• The $RANDOM variable in Bash carried over values from a previous
  execution for later jobs. This is fixed and the $RANDOM variable
  generates a new random number for each use. (BZ#492908)
  
• When Bash ran a shell script with an embedded null character, bash's
  source builtin parsed the script incorrectly. This is fixed and
  bash's source builtin correctly parses shell script null characters.
  (BZ#503701)
  
• The bash manual page for "trap" did not mention that signals ignored upon
  entry cannot be listed later. The manual page was updated for this update
  and now specifically notes that "Signals ignored upon entry to the shell
  cannot be trapped, reset or listed". (BZ#504904)
  
• Bash's readline incorrectly displayed additional text when resizing
  the terminal window when text spanned more than one line, which caused
  incorrect display output. This is now fixed to ensure that text in more
  than one line in a resized window displays as expected. (BZ#525474)
  
• Previously, bash incorrectly displayed "Broken pipe" messages for
  builtins like "echo" and "printf" when output did not succeed due to
  EPIPE. This is fixed to ensure that the unnecessary "Broken pipe"
  messages no longer display. (BZ#546529)
  
• Inserts with the repeat function were not possible after a deletion in
  vi-mode. This has been corrected and, with this update, the repeat function
  works as expected after a deletion. (BZ#575076)
  
• In some situations, bash incorrectly appended "/" to files instead of
  just directories during tab-completion, causing incorrect
  auto-completions. This is fixed and auto-complete appends "/" only to
  directories. (BZ#583919)
  
• Bash had a memory leak in the "read" builtin when the number of fields
  being read was not equal to the number of variables passed as arguments,
  causing a shell script crash. This is fixed to prevent a memory leak and
  shell script crash. (BZ#618393)
  
• /usr/share/doc/bash-3.2/loadables in the bash package contained source
  files which would not build due to missing C header files. With this
  update, the unusable (and unbuildable) source files were removed from the
  package. (BZ#663656)
  

This update also adds the following enhancement:

• The system-wide "/etc/bash.bash_logout" bash logout file is now enabled.
  This allows administrators to write system-wide logout actions for all
  users. (BZ#592979)
  

Users of bash are advised to upgrade to this updated package, which
contains backported patches to resolve these issues and add this
enhancement.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 448508 - Parsing of {} broken; breaks startup scripts
• BZ - 463880 - bash completion in UTF8 locale has cursor positioning errors with long $PS1
• BZ - 475474 - CVE-2008-5374 bash: Insecure temporary file use in aliasconv.sh, aliasconv.bash, cshtobash (symlink attack)
• BZ - 484809 - [RHEL5] bash includes Control-D in "bad ELF interpreter" message
• BZ - 492908 - $RANDOM value remains the same
• BZ - 503701 - Cannot process scripts beyond an embedded NULL character when running in 'source' mode
• BZ - 504904 - trap -p not displaying ignored signal when run from child bash
• BZ - 525474 - bash/readline not detecting window resize properly
• BZ - 583919 - tab-completion appends slash to non-directories
• BZ - 592979 - system global bash.bash_logout is diabled in config-top.h
• BZ - 618393 - memory leak in bash reading files
• BZ - 663656 - Unusable loadables in /doc

CVEs

• CVE-2008-5374

References

• https://access.redhat.com/security/updates/classification/#low

Red Hat Enterprise Linux Server 5

SRPM
bash-3.2-32.el5.src.rpm	SHA-256: e7aebfb0fba14d52db7f7703f5275b4ca5e43e564a50818cc6883c38bfc6ca74
x86_64
bash-3.2-32.el5.x86_64.rpm	SHA-256: a73a67da611dd982274c071f0b6f733fdcfdc63911c8066fb5dd0f02a738c395
ia64
bash-3.2-32.el5.i386.rpm	SHA-256: 300aa2813b9ca1f9c7a2921892f3fab355187a43432f0b755b4efd0ebdcd92f8
bash-3.2-32.el5.ia64.rpm	SHA-256: 7808f2d8f4adebc73d5fc364c7acddbd0e96abf55df521ac3af37e00352a3f28
i386
bash-3.2-32.el5.i386.rpm	SHA-256: 300aa2813b9ca1f9c7a2921892f3fab355187a43432f0b755b4efd0ebdcd92f8

Red Hat Enterprise Linux Workstation 5

SRPM
bash-3.2-32.el5.src.rpm	SHA-256: e7aebfb0fba14d52db7f7703f5275b4ca5e43e564a50818cc6883c38bfc6ca74
x86_64
bash-3.2-32.el5.x86_64.rpm	SHA-256: a73a67da611dd982274c071f0b6f733fdcfdc63911c8066fb5dd0f02a738c395
i386
bash-3.2-32.el5.i386.rpm	SHA-256: 300aa2813b9ca1f9c7a2921892f3fab355187a43432f0b755b4efd0ebdcd92f8

Red Hat Enterprise Linux Desktop 5

SRPM
bash-3.2-32.el5.src.rpm	SHA-256: e7aebfb0fba14d52db7f7703f5275b4ca5e43e564a50818cc6883c38bfc6ca74
x86_64
bash-3.2-32.el5.x86_64.rpm	SHA-256: a73a67da611dd982274c071f0b6f733fdcfdc63911c8066fb5dd0f02a738c395
i386
bash-3.2-32.el5.i386.rpm	SHA-256: 300aa2813b9ca1f9c7a2921892f3fab355187a43432f0b755b4efd0ebdcd92f8

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
bash-3.2-32.el5.src.rpm	SHA-256: e7aebfb0fba14d52db7f7703f5275b4ca5e43e564a50818cc6883c38bfc6ca74
s390x
bash-3.2-32.el5.s390x.rpm	SHA-256: c28b2fa01df2e8c341f540946ad5868386d19a9d64187314cf6fda2c16405857

Red Hat Enterprise Linux for Power, big endian 5

SRPM
bash-3.2-32.el5.src.rpm	SHA-256: e7aebfb0fba14d52db7f7703f5275b4ca5e43e564a50818cc6883c38bfc6ca74
ppc
bash-3.2-32.el5.ppc.rpm	SHA-256: 75edefa8500b926823133fd018edc1c88851aea6aa677ca12646a2f812a24d61

Red Hat Enterprise Linux Server from RHUI 5

SRPM
bash-3.2-32.el5.src.rpm	SHA-256: e7aebfb0fba14d52db7f7703f5275b4ca5e43e564a50818cc6883c38bfc6ca74
x86_64
bash-3.2-32.el5.x86_64.rpm	SHA-256: a73a67da611dd982274c071f0b6f733fdcfdc63911c8066fb5dd0f02a738c395
i386
bash-3.2-32.el5.i386.rpm	SHA-256: 300aa2813b9ca1f9c7a2921892f3fab355187a43432f0b755b4efd0ebdcd92f8