All versions of Centrify DirectControl
Are Centrify Server Suite Products / Components affected by CVE-2014-6271 ( Bash ShellShock )?
This vulnerability does exist in bash shell. For more details, please see the below link provided as a courtesy.
1) Centrify does not own the bash shell.
2) Centrify does not redistribute bash, or any variation of it.
The OS vendors will have to address fixing bash itself.
For Centrify Server Suite of products:
a) Centrify's Dzsh is variation from BSD Bourne shell. It is not bash. It does not have this issue.
b) Centrify's Dash (Direct Audit shell) is actually a shell in name only. It does not execute anything, nor set environmental variables. It is a Centrify written code to
decide if to audit session, and if so, to set up the structures to do so.
Note: If customer is running DirectAudit 1.x or 2.x (i.e., Suite 2012.3 or earlier) and configured to do shell auditing, please disable shell auditing before applying the patch to bash and re-enable shell auditing afterwards. The command dacontrol can be used to enable/disable DirectAudit (see output of ‘dacontrol –help’ for detailed usage information).
c) Centrify's dzdo is not affected however please be aware of the note.
Note: All shell scripts that invokes /bin/sh on RedHat will actually invoke bash and therefore will be affected.
/usr/share/centrifydc/bin/dzdo is actually a shell script that invokes the real dzdo (/usr/share/centrifydc/libexec/dzdo) as shown below.
[username@localhost]$ cat /usr/share/centrifydc/bin/dzdo
exec /usr/share/centrifydc/libexec/dzdo "$@"
d) If customer is using the dzdo validator feature in dzdo, a user can exploit this vulnerability since the validator is run as a shell script. This is due to the
vulnerability in bash.
Customers are STRONGLY advised to apply the bash fix ASAP. Otherwise, they are advised to do the followings:
1. Use /usr/share/centrifydc/libexec/dzdo directly, not by way of the script.
2. Disable the dzdo validator feature in dzdo by comment out these lines in /etc/centrifydc/centrifydc.conf:
The dzsh restricted environment shell is a customized Bourne shell for DirectAuthorize that provides environment variables, job control, command history, and command access as defined by DirectAuthorize roles. The restricted environment only allows the user to run the specific commands that have been defined in the user’s assigned DirectAuthorize roles.
DirectAudit 1.x uses a shell wrapper named “dash”. The DirectAudit 1.x dash shell creates a symbolic link pointing “/bin/sh” to “/bin/dash” (Centrify dash).
Centrify has since renamed the dash shell to “cdash” in version 2.x and higher