Re: more bash parser bugs (CVE-2014-6277, CVE-2014-6278)

[Michal Zalewski <lcamtuf () coredump cx>]

Nope. There are no CVEs assigned for general hardening (e.g.,
Florian's patch) and the ordering of CVE IDs isn't necessarily
chronological (because larger vendors get their own ranges to allocate
without consulting any central authority).

In true chronological order, it went like this:

* CVE-2014-6271 - original RCE found by Stephane. Fixed by bash43-025
and corresponding Sep 24 entries for other versions.

* CVE-2014-7169 - file creation / token consumption bug found by
Tavis. Fixed by bash43-026 & co (Sep 26)

* CVE-2014-7186 - a probably no-sec-risk 10+ here-doc crash found by
Florian and Todd. Fixed by bash43-028 & co (Oct 1).

* CVE-2014-7187 - a non-crashing, probably no-sec-risk off-by-one
found by Florian.  Fixed by bash43-028 & co (Oct 1).

* CVE-2014-6277 - uninitialized memory issue, almost certainly RCE
found by me. No specific patch yet.

* CVE-2014-6278 - command injection RCE found by me. No specific patch yet.

*All* of these are mitigated by Florian's unofficial patch
(http://www.openwall.com/lists/oss-security/2014/09/25/13) or its
upstream version (bash43-027 & co, released on Sep 27). If you have
that patch, there's no point in obsessing about the status of
individual bugs, because they should no longer pose a security risk.

And you don't have it, patch your system now instead of waiting for
any additional patches for '77 and '78 =)

/mz