Is CVE-2016-7543 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-7543 being exploited in the wild.

How severe is CVE-2016-7543?

High severity, with a CVSS score of 8.4, published 19 January 2017.

Is there a fix for CVE-2016-7543?

A patch was published on 2016-09-26: Bash 4.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-7543 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2016-7543?

Check whether you run Gnu Bash, Red Hat Enterprise Linux 6 or Red Hat Enterprise Linux 7 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-7543: GNU Bash privilege escalation via SHELLOPTS and PS4 variables

CVE-2016-7543 · Severity: high · CVSS 8.4 · Published 2017-01-19

A vulnerability in the Bash command-line shell allows local users to gain full administrative (root) control over a system. By providing specially crafted environment variables, an attacker can trick certain high-privilege programs into executing unauthorized commands. This could lead to a complete system takeover and unauthorized access to all data on the machine.

Technologies: Gnu Bash, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7. Vendors: Gnu, Red Hat.

Quick answers

Is CVE-2016-7543 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-7543 being exploited in the wild.
How severe is CVE-2016-7543?: High severity, with a CVSS score of 8.4, published 19 January 2017.
Which products and versions are affected?: Gnu Bash before 4.4.
Is there a fix for CVE-2016-7543?: A patch was published on 2016-09-26: Bash 4.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-7543 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2016-7543?: Check whether you run Gnu Bash, Red Hat Enterprise Linux 6 or Red Hat Enterprise Linux 7 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in GNU Bash due to improper handling of the SHELLOPTS and PS4 environment variables. When Bash is invoked by a setuid program, it may inherit these variables from the environment; specifically, the PS4 variable can be manipulated to perform command substitution during trace output (xtrace). A local, authenticated attacker can exploit this by crafting these variables to execute arbitrary commands with the elevated privileges of the setuid binary, typically resulting in root access. The issue was addressed in Bash 4.4 by ensuring shells running as root no longer inherit PS4 from the environment.

Affected products

GNU Bash before 4.4
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Fedora Project Fedora 23, 24, 25

Timeline

2016-09-26: disclosed: Public disclosure on oss-security mailing list
2016-09-26: patched: Bash 4.4 released with fix
2017-01-19: advisory: NVD publication date
2017-03-21: patched: Red Hat Enterprise Linux 6 security update issued
2017-08-01: patched: Red Hat Enterprise Linux 7 security update issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.