Executive Summary
Informations | |||
---|---|---|---|
Name | MDVSA-2015:164 | First vendor Publication | 2015-03-29 |
Vendor | Mandriva | Last vendor Modification | 2015-03-29 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 10 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Updated bash packages fix security vulnerability: A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue (CVE-2014-6271). This vulnerability can be exposed and exploited through several other pieces of software and should be considered highly critical. Please refer to the RedHat Knowledge Base article and blog post for more information. It was found that the fix for CVE-2014-6271 was incomplete, and Bash still allowed certain characters to be injected into other environments via specially crafted environment variables. An attacker could potentially use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue (CVE-2014-7169). Bash has been updated to version 4.2 patch level 50, which further mitigates ShellShock-type vulnerabilities. Two such issues have already been discovered (CVE-2014-6277, CVE-2014-6278). See the RedHat article on the backward-incompatible changes introduced by the latest patch, caused by adding prefixes and suffixes to the variable names used for exporting functions. Note that the RedHat article mentions these variable names will have parentheses "()" at the end of their names, however, the latest upstream patch uses two percent signs "%%" at the end instead. Two other unrelated security issues in the parser have also been fixed in this update (CVE-2014-7186, CVE-2014-7187). All users and sysadmins are advised to update their bash package immediately. |
Original Source
Url : http://www.mandriva.com/security/advisories?name=MDVSA-2015:164 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
67 % | CWE-78 | Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection') (CWE/SANS Top 25) |
33 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:26231 | |||
Oval ID: | oval:org.mitre.oval:def:26231 | ||
Title: | USN-2380-1 -- bash vulnerabilities | ||
Description: | Several security issues were fixed in Bash. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-2380-1 CVE-2014-6277 CVE-2014-6278 | Version: | 3 |
Platform(s): | Ubuntu 14.04 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | bash |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26290 | |||
Oval ID: | oval:org.mitre.oval:def:26290 | ||
Title: | USN-2363-1 -- bash vulnerability | ||
Description: | Bash allowed bypassing environment restrictions in certain environments. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-2363-1 CVE-2014-7169 | Version: | 3 |
Platform(s): | Ubuntu 14.04 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | bash |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26447 | |||
Oval ID: | oval:org.mitre.oval:def:26447 | ||
Title: | Vulnerability affecting GNU Bash | ||
Description: | GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-7169 | Version: | 4 |
Platform(s): | Sun Solaris 10 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26521 | |||
Oval ID: | oval:org.mitre.oval:def:26521 | ||
Title: | RHSA-2014:1293: bash security update (Critical) | ||
Description: | The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux. A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. (CVE-2014-6271) For additional information on the CVE-2014-6271 flaw, refer to the Knowledgebase article at https://access.redhat.com/articles/1200223 Red Hat would like to thank Stephane Chazelas for reporting this issue. All bash users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2014:1293-00 CESA-2014:1293 CVE-2014-6271 | Version: | 3 |
Platform(s): | Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 7 CentOS Linux 5 CentOS Linux 6 CentOS Linux 7 | Product(s): | bash |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26539 | |||
Oval ID: | oval:org.mitre.oval:def:26539 | ||
Title: | USN-2362-1 -- bash vulnerability | ||
Description: | Bash allowed bypassing environment restrictions in certain environments. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-2362-1 CVE-2014-6271 | Version: | 3 |
Platform(s): | Ubuntu 14.04 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | bash |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26555 | |||
Oval ID: | oval:org.mitre.oval:def:26555 | ||
Title: | ELSA-2014-3075 -- bash security update (Critical) | ||
Description: | [4.1.2-15.1.0.1] - Preliminary fix for CVE-2014-7169 | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-3075 CVE-2014-7169 | Version: | 3 |
Platform(s): | Oracle Linux 6 | Product(s): | bash |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:26589 | |||
Oval ID: | oval:org.mitre.oval:def:26589 | ||
Title: | RHSA-2014:1306: bash security update (Important) | ||
Description: | The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux. It was found that the fix for CVE-2014-6271 was incomplete, and Bash still allowed certain characters to be injected into other environments via specially crafted environment variables. An attacker could potentially use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. (CVE-2014-7169) Applications which directly create bash functions as environment variables need to be made aware of changes to the way names are handled by this update. For more information see the Knowledgebase article at https://access.redhat.com/articles/1200223 Note: Docker users are advised to use "yum update" within their containers, and to commit the resulting changes. For additional information on CVE-2014-6271 and CVE-2014-7169, refer to the aforementioned Knowledgebase article. All bash users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2014:1306-00 CESA-2014:1306 CVE-2014-7169 | Version: | 3 |
Platform(s): | Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 5 CentOS Linux 5 CentOS Linux 6 CentOS Linux 7 | Product(s): | bash |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26614 | |||
Oval ID: | oval:org.mitre.oval:def:26614 | ||
Title: | ELSA-2014-3077 -- bash security update (Critical) | ||
Description: | [3.2-33.1.0.1] - Preliminary fix for CVE-2014-7169 | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-3077 CVE-2014-7169 | Version: | 3 |
Platform(s): | Oracle Linux 5 | Product(s): | bash |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:26615 | |||
Oval ID: | oval:org.mitre.oval:def:26615 | ||
Title: | ELSA-2014-3076 -- bash security update (Critical) | ||
Description: | [4.2.45-5.2.0.1] - Preliminary fix for CVE-2014-7169 | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-3076 CVE-2014-7169 | Version: | 3 |
Platform(s): | Oracle Linux 7 | Product(s): | bash |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:26631 | |||
Oval ID: | oval:org.mitre.oval:def:26631 | ||
Title: | SUSE-SU-2014:1247-1 -- Security update for bash | ||
Description: | The command-line shell 'bash' evaluates environment variables, which allows the injection of characters and might be used to access files on the system in some circumstances (CVE-2014-7169). Please note that this issue is different from a previously fixed vulnerability tracked under CVE-2014-6271 and is less serious due to the special, non-default system configuration that is needed to create an exploitable situation. To remove further exploitation potential we now limit the function-in-environment variable to variables prefixed with BASH_FUNC_. This hardening feature is work in progress and might be improved in later updates. Additionally, two other security issues have been fixed: * CVE-2014-7186: Nested HERE documents could lead to a crash of bash. * CVE-2014-7187: Nesting of for loops could lead to a crash of bash. Security Issues: * CVE-2014-7169 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169> * CVE-2014-7186 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186> * CVE-2014-7187 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187> | ||
Family: | unix | Class: | patch |
Reference(s): | SUSE-SU-2014:1247-1 CVE-2014-7169 CVE-2014-6271 CVE-2014-7186 CVE-2014-7187 | Version: | 3 |
Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 SUSE Linux Enterprise Desktop 11 | Product(s): | bash |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26642 | |||
Oval ID: | oval:org.mitre.oval:def:26642 | ||
Title: | DSA-3032-1 bash - security update | ||
Description: | Stephane Chazelas discovered a vulnerability in bash, the GNU Bourne-Again Shell, related to how environment variables are processed. In many common configurations, this vulnerability is exploitable over the network, especially if bash has been configured as the system shell. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-3032-1 CVE-2014-6271 | Version: | 3 |
Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | bash |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26665 | |||
Oval ID: | oval:org.mitre.oval:def:26665 | ||
Title: | DSA-3035-1 bash - security update | ||
Description: | Tavis Ormandy discovered that the patch applied to fix <a href="https://security-tracker.debian.org/tracker/CVE-2014-6271">CVE-2014-6271</a> released in DSA-3032-1 for bash, the GNU Bourne-Again Shell, was incomplete and could still allow some characters to be injected into another environment (<a href="https://security-tracker.debian.org/tracker/CVE-2014-7169">CVE-2014-7169</a>). With this update prefix and suffix for environment variable names which contain shell functions are added as hardening measure. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-3035-1 CVE-2014-7169 CVE-2014-6271 | Version: | 3 |
Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | bash |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26685 | |||
Oval ID: | oval:org.mitre.oval:def:26685 | ||
Title: | ELSA-2014-1294 -- bash security update (Critical) | ||
Description: | The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux. A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. (CVE-2014-6271) For additional information on the CVE-2014-6271 flaw, refer to the Knowledgebase article at <A HREF="https://access.redhat.com/articles/1200223">https://access.redhat.com/articles/1200223</A> Red Hat would like to thank Stephane Chazelas for reporting this issue. All bash users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-1294 CVE-2014-6271 | Version: | 3 |
Platform(s): | Oracle Linux 4 | Product(s): | bash |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:26712 | |||
Oval ID: | oval:org.mitre.oval:def:26712 | ||
Title: | ELSA-2014-3078 -- bash security update (Critical) | ||
Description: | [3.0-27.0.2] - Preliminary fix for CVE-2014-7169 | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-3078 CVE-2014-7169 | Version: | 3 |
Platform(s): | Oracle Linux 4 | Product(s): | bash |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:26745 | |||
Oval ID: | oval:org.mitre.oval:def:26745 | ||
Title: | USN-2363-2 -- bash vulnerability | ||
Description: | Bash allowed bypassing environment restrictions in certain environments. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-2363-2 CVE-2014-7169 | Version: | 3 |
Platform(s): | Ubuntu 14.04 | Product(s): | bash |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:26764 | |||
Oval ID: | oval:org.mitre.oval:def:26764 | ||
Title: | Vulnerability affecting GNU Bash | ||
Description: | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-6271 | Version: | 4 |
Platform(s): | Sun Solaris 10 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26923 | |||
Oval ID: | oval:org.mitre.oval:def:26923 | ||
Title: | ELSA-2014-1293 -- bash security update (Critical) | ||
Description: | The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux. A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. (CVE-2014-6271) For additional information on the CVE-2014-6271 flaw, refer to the Knowledgebase article at <A HREF="https://access.redhat.com/articles/1200223">https://access.redhat.com/articles/1200223</A> Red Hat would like to thank Stephane Chazelas for reporting this issue. All bash users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-1293 CVE-2014-6271 | Version: | 3 |
Platform(s): | Oracle Linux 6 Oracle Linux 7 Oracle Linux 5 | Product(s): | bash |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:26928 | |||
Oval ID: | oval:org.mitre.oval:def:26928 | ||
Title: | ELSA-2014-3079 -- bash security update (Important) | ||
Description: | [3.0-27.0.3] - Rework env function definition for safety (Florian Weimer) [CVE-2014-7169] | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-3079 CVE-2014-7169 | Version: | 3 |
Platform(s): | Oracle Linux 4 | Product(s): | bash |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:27118 | |||
Oval ID: | oval:org.mitre.oval:def:27118 | ||
Title: | ELSA-2014-1306 -- bash security update (Important) | ||
Description: | The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux. It was found that the fix for CVE-2014-6271 was incomplete, and Bash still allowed certain characters to be injected into other environments via specially crafted environment variables. An attacker could potentially use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. (CVE-2014-7169) Applications which directly create bash functions as environment variables need to be made aware of changes to the way names are handled by this update. Note that certain services, screen sessions, and tmux sessions may need to be restarted, and affected interactive users may need to re-login. Installing these updated packages without restarting services will address the vulnerability, but functionality may be impacted until affected services are restarted. For more information see the Knowledgebase article at <A HREF="https://access.redhat.com/articles/1200223">https://access.redhat.com/articles/1200223</A> Note: Docker users are advised to use "yum update" within their containers, and to commit the resulting changes. For additional information on CVE-2014-6271 and CVE-2014-7169, refer to the aforementioned Knowledgebase article. All bash users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-1306 CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 CVE-2014-6271 | Version: | 3 |
Platform(s): | Oracle Linux 7 Oracle Linux 6 Oracle Linux 5 | Product(s): | bash |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:27163 | |||
Oval ID: | oval:org.mitre.oval:def:27163 | ||
Title: | USN-2364-1 -- bash vulnerabilities | ||
Description: | Several security issues were fixed in Bash. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-2364-1 CVE-2014-7186 CVE-2014-7187 | Version: | 3 |
Platform(s): | Ubuntu 14.04 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | bash |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:27461 | |||
Oval ID: | oval:org.mitre.oval:def:27461 | ||
Title: | ELSA-2014-3093 -- bash security update (important) | ||
Description: | [4.1.2-29.0.1] - Fix segfaults from CVE-2014-6277 and CVE-2014-6278 completely. [orabug 19905294] | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-3093 CVE-2014-6277 CVE-2014-6278 | Version: | 3 |
Platform(s): | Oracle Linux 6 | Product(s): | bash |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:27830 | |||
Oval ID: | oval:org.mitre.oval:def:27830 | ||
Title: | SUSE-SU-2014:1260-1 -- bash (critical) | ||
Description: | Bash was updated to fix unexpected code execution with environment variables (CVE-2014-6271). | ||
Family: | unix | Class: | patch |
Reference(s): | SUSE-SU-2014:1260-1 CVE-2014-6271 | Version: | 3 |
Platform(s): | SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:27981 | |||
Oval ID: | oval:org.mitre.oval:def:27981 | ||
Title: | SUSE-SU-2014:1259-1 -- bash (important) | ||
Description: | The command-line shell 'bash' evaluates environment variables, which allows the injection of characters and might be used to access files on the system in some circumstances (CVE-2014-7169). Please note that this issue is different from a previously fixed vulnerability tracked under CVE-2014-6271 and it is less serious due to the special, non-default system configuration that is needed to create an exploitable situation. To remove further exploitation potential we now limit the function-in-environment variable to variables prefixed with BASH_FUNC_ . This hardening feature is work in progress and might be improved in later updates. Additionaly two more security issues were fixed in bash: CVE-2014-7186: Nested HERE documents could lead to a crash of bash. CVE-2014-7187: Nesting of for loops could lead to a crash of bash. | ||
Family: | unix | Class: | patch |
Reference(s): | SUSE-SU-2014:1259-1 CVE-2014-7169 CVE-2014-6271 CVE-2014-7186 CVE-2014-7187 | Version: | 3 |
Platform(s): | SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Desktop 12 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:28062 | |||
Oval ID: | oval:org.mitre.oval:def:28062 | ||
Title: | VMware product updates address critical Bash security vulnerabilities | ||
Description: | GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-7169 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.1 VMWare ESX Server 4.0 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:28091 | |||
Oval ID: | oval:org.mitre.oval:def:28091 | ||
Title: | VMware product updates address critical Bash security vulnerabilities | ||
Description: | GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-6277 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.1 VMWare ESX Server 4.0 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:28195 | |||
Oval ID: | oval:org.mitre.oval:def:28195 | ||
Title: | VMware product updates address critical Bash security vulnerabilities | ||
Description: | GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-6278 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.1 VMWare ESX Server 4.0 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:28237 | |||
Oval ID: | oval:org.mitre.oval:def:28237 | ||
Title: | ELSA-2014-3092 -- bash security update (important) | ||
Description: | [4.2.45-5.4.0.1] - Fix segfaults from CVE-2014-6277 and CVE-2014-6278 completely. [orabug 19905256] | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-3092 CVE-2014-6277 CVE-2014-6278 | Version: | 3 |
Platform(s): | Oracle Linux 7 | Product(s): | bash |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:28263 | |||
Oval ID: | oval:org.mitre.oval:def:28263 | ||
Title: | ELSA-2014-3094 -- bash security update (important) | ||
Description: | [3.2-33.4.0.1] - Fix segfaults from CVE-2014-6277 and CVE-2014-6278 completely. [orabug 19905421] | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-3094 CVE-2014-6277 CVE-2014-6278 | Version: | 3 |
Platform(s): | Oracle Linux 5 | Product(s): | bash |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:28319 | |||
Oval ID: | oval:org.mitre.oval:def:28319 | ||
Title: | VMware product updates address critical Bash security vulnerabilities | ||
Description: | The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-7186 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.1 VMWare ESX Server 4.0 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:28331 | |||
Oval ID: | oval:org.mitre.oval:def:28331 | ||
Title: | VMware product updates address critical Bash security vulnerabilities | ||
Description: | GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-6271 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.1 VMWare ESX Server 4.0 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:28370 | |||
Oval ID: | oval:org.mitre.oval:def:28370 | ||
Title: | VMware product updates address critical Bash security vulnerabilities | ||
Description: | Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2014-7187 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.1 VMWare ESX Server 4.0 | Product(s): | |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
SAINT Exploits
Description | Link |
---|---|
Bash environment variable command injection in Cisco UCS Manager | More info here |
Bash environment variable code injection over HTTP | More info here |
Bash Environment Variable Handling Shell Command Injection Via CUPS | More info here |
ShellShock DHCP Server | More info here |
ExploitDB Exploits
id | Description |
---|---|
2014-11-03 | PHP 5.x Shellshock Exploit (bypass disable_functions) |
2014-10-29 | CUPS Filter Bash Environment Variable Code Injection |
2014-10-27 | Binary File Descriptor Library (libbfd) - Out-of-Bounds Crash |
2014-10-04 | OpenVPN 2.2.29 - ShellShock Exploit |
2014-10-02 | GNU bash 4.3.11 Environment Variable dhclient Exploit |
2014-10-01 | IPFire Cgi Web Interface Authenticated Bash Environment Variable Code Injecti... |
2014-09-25 | GNU bash Environment Variable Command Injection (MSF) |
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2014-09-25 | IAVM : 2014-A-0142 - GNU Bash Shell Code Execution Vulnerability Severity : Category I - VMSKEY : V0054753 |
Snort® IPS/IDS
Date | Description |
---|---|
2015-07-13 | Linux.Trojan.ChinaZ outbound connection RuleID : 34847 - Revision : 3 - Type : MALWARE-CNC |
2014-10-30 | Bash environment variable injection attempt RuleID : 32366-community - Revision : 2 - Type : OS-OTHER |
2014-12-02 | Bash environment variable injection attempt RuleID : 32366 - Revision : 2 - Type : OS-OTHER |
2014-10-24 | Bash CGI environment variable injection attempt RuleID : 32336-community - Revision : 2 - Type : OS-OTHER |
2014-11-25 | Bash CGI environment variable injection attempt RuleID : 32336 - Revision : 2 - Type : OS-OTHER |
2014-10-24 | Bash CGI environment variable injection attempt RuleID : 32335-community - Revision : 2 - Type : OS-OTHER |
2014-11-25 | Bash CGI environment variable injection attempt RuleID : 32335 - Revision : 2 - Type : OS-OTHER |
2014-10-03 | Bash environment variable injection attempt RuleID : 32069-community - Revision : 3 - Type : OS-OTHER |
2014-11-16 | Bash environment variable injection attempt RuleID : 32069 - Revision : 3 - Type : OS-OTHER |
2014-11-16 | Bash CGI nested loops word_lineno denial of service attempt RuleID : 32049 - Revision : 2 - Type : OS-OTHER |
2014-11-16 | Bash CGI nested loops word_lineno denial of service attempt RuleID : 32047 - Revision : 2 - Type : OS-OTHER |
2014-11-16 | Bash redir_stack here document handling denial of service attempt RuleID : 32046 - Revision : 2 - Type : OS-OTHER |
2014-11-16 | Bash redir_stack here document handling denial of service attempt RuleID : 32045 - Revision : 2 - Type : OS-OTHER |
2014-10-01 | Bash environment variable injection attempt RuleID : 32043-community - Revision : 3 - Type : OS-OTHER |
2014-11-16 | Bash environment variable injection attempt RuleID : 32043 - Revision : 3 - Type : OS-OTHER |
2014-10-01 | Bash environment variable injection attempt RuleID : 32042-community - Revision : 4 - Type : OS-OTHER |
2014-11-16 | Bash environment variable injection attempt RuleID : 32042 - Revision : 4 - Type : OS-OTHER |
2014-10-01 | Bash environment variable injection attempt RuleID : 32041-community - Revision : 4 - Type : OS-OTHER |
2014-11-16 | Bash environment variable injection attempt RuleID : 32041 - Revision : 4 - Type : OS-OTHER |
2014-10-01 | Bash environment variable injection attempt RuleID : 32039-community - Revision : 3 - Type : OS-OTHER |
2014-11-16 | Bash environment variable injection attempt RuleID : 32039 - Revision : 3 - Type : OS-OTHER |
2014-10-01 | Bash environment variable injection attempt RuleID : 32038-community - Revision : 3 - Type : OS-OTHER |
2014-11-16 | Bash environment variable injection attempt RuleID : 32038 - Revision : 3 - Type : OS-OTHER |
2014-09-25 | Malicious DHCP server bash environment variable injection attempt RuleID : 31985-community - Revision : 6 - Type : OS-OTHER |
2014-11-16 | Malicious DHCP server bash environment variable injection attempt RuleID : 31985 - Revision : 6 - Type : OS-OTHER |
2014-09-25 | Bash CGI environment variable injection attempt RuleID : 31978-community - Revision : 5 - Type : OS-OTHER |
2014-11-16 | Bash CGI environment variable injection attempt RuleID : 31978 - Revision : 5 - Type : OS-OTHER |
2014-09-25 | Bash CGI environment variable injection attempt RuleID : 31977-community - Revision : 5 - Type : OS-OTHER |
2014-11-16 | Bash CGI environment variable injection attempt RuleID : 31977 - Revision : 5 - Type : OS-OTHER |
2014-09-25 | Bash CGI environment variable injection attempt RuleID : 31976-community - Revision : 5 - Type : OS-OTHER |
2014-11-16 | Bash CGI environment variable injection attempt RuleID : 31976 - Revision : 5 - Type : OS-OTHER |
2014-09-25 | Bash CGI environment variable injection attempt RuleID : 31975-community - Revision : 6 - Type : OS-OTHER |
2014-11-16 | Bash CGI environment variable injection attempt RuleID : 31975 - Revision : 6 - Type : OS-OTHER |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2017-12-04 | Name : The remote host is missing a vendor-supplied security patch. File : check_point_gaia_sk102673.nasl - Type : ACT_GATHER_INFO |
2017-03-30 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2017-0050.nasl - Type : ACT_GATHER_INFO |
2016-12-05 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1374.nasl - Type : ACT_GATHER_INFO |
2016-11-23 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-2872-1.nasl - Type : ACT_GATHER_INFO |
2016-02-02 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_bash_20141031_2.nasl - Type : ACT_GATHER_INFO |
2015-12-30 | Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2014-0010_remote.nasl - Type : ACT_GATHER_INFO |
2015-10-05 | Name : The remote host is missing a Mac OS X update that fixes multiple security vul... File : macosx_10_11.nasl - Type : ACT_GATHER_INFO |
2015-08-25 | Name : The remote IBM Storwize V7000 Unified device is affected by multiple vulnerab... File : ibm_storwize_1_5_0_4.nasl - Type : ACT_GATHER_INFO |
2015-04-06 | Name : The remote web server is affected by a remote code execution vulnerability. File : bash_cve_2014_6278.nasl - Type : ACT_ATTACK |
2015-03-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-164.nasl - Type : ACT_GATHER_INFO |
2015-03-26 | Name : The remote Debian host is missing a security update. File : debian_DLA-63.nasl - Type : ACT_GATHER_INFO |
2015-01-29 | Name : The remote host is missing a Mac OS X update that fixes multiple vulnerabilit... File : macosx_10_10_2.nasl - Type : ACT_GATHER_INFO |
2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_bash_20141031.nasl - Type : ACT_GATHER_INFO |
2014-12-22 | Name : The remote device is affected by multiple vulnerabilities. File : juniper_space_jsa10648.nasl - Type : ACT_GATHER_INFO |
2014-11-26 | Name : The remote Cisco TelePresence Conductor device is affected by a command injec... File : cisco_telepresence_conductor_CSCur02103.nasl - Type : ACT_GATHER_INFO |
2014-11-21 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-3092.nasl - Type : ACT_GATHER_INFO |
2014-11-21 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-3093.nasl - Type : ACT_GATHER_INFO |
2014-11-21 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2014-3094.nasl - Type : ACT_GATHER_INFO |
2014-11-13 | Name : The remote host is affected by a code injection vulnerability known as Shells... File : mcafee_ngfw_SB10085.nasl - Type : ACT_GATHER_INFO |
2014-11-12 | Name : The remote host is affected by a code injection vulnerability known as Shells... File : mcafee_web_gateway_sb10085.nasl - Type : ACT_GATHER_INFO |
2014-11-12 | Name : The remote host has an application installed that is affected by multiple vul... File : vmware_vcenter_converter_2014-0010.nasl - Type : ACT_GATHER_INFO |
2014-11-11 | Name : The remote host is missing a vendor-supplied security patch. File : cisco_cups_CSCur05454.nasl - Type : ACT_GATHER_INFO |
2014-11-11 | Name : The remote host is affected by a code injection vulnerability known as Shells... File : mcafee_email_gateway_SB10085.nasl - Type : ACT_GATHER_INFO |
2014-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1294.nasl - Type : ACT_GATHER_INFO |
2014-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1311.nasl - Type : ACT_GATHER_INFO |
2014-11-08 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2014-1354.nasl - Type : ACT_GATHER_INFO |
2014-11-06 | Name : The remote host has a virtualization appliance installed that is affected by ... File : vcenter_operations_manager_vmsa_2014-0010.nasl - Type : ACT_GATHER_INFO |
2014-11-04 | Name : The remote host has a device management application installed that is affecte... File : vmware_workspace_portal_vmsa2014-0010.nasl - Type : ACT_GATHER_INFO |
2014-11-03 | Name : The remote security device is missing a vendor-supplied security patch. File : cisco-sa-CSCur01959-asa-cx.nasl - Type : ACT_GATHER_INFO |
2014-11-03 | Name : The management application installed on the remote host is affected by a comm... File : cisco-sa-CSCur01959-prsm.nasl - Type : ACT_GATHER_INFO |
2014-11-03 | Name : The remote SIP server uses scripts that allow remote command execution via Sh... File : shellshock_sip_invite.nasl - Type : ACT_ATTACK |
2014-11-03 | Name : The remote host is affected by a command injection vulnerability. File : vmware_nsx_vmsa_2014_0010.nasl - Type : ACT_GATHER_INFO |
2014-10-31 | Name : The remote host is running a vulnerable version of Bash. File : cisco_ucs_director_CSCur02877.nasl - Type : ACT_GATHER_INFO |
2014-10-31 | Name : The remote host has a virtualization appliance installed that is affected by ... File : vmware_vsphere_replication_vmsa_2014_0010.nasl - Type : ACT_GATHER_INFO |
2014-10-28 | Name : The remote host has a mail agent installed that allows remote command executi... File : shellshock_mail_agents.nasl - Type : ACT_DESTRUCTIVE_ATTACK |
2014-10-27 | Name : The remote device is running a version of NX-OS that is affected by Shellshock. File : cisco-sa-20140926-bash-nxos.nasl - Type : ACT_GATHER_INFO |
2014-10-21 | Name : The version of Cisco TelePresence Video Communication Server installed on the... File : cisco_telepresence_vcs_CSCur01461.nasl - Type : ACT_GATHER_INFO |
2014-10-21 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-594.nasl - Type : ACT_GATHER_INFO |
2014-10-21 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-595.nasl - Type : ACT_GATHER_INFO |
2014-10-20 | Name : The remote host is affected by a remote code execution vulnerability. File : palo_alto_PAN-SA-2014-0004.nasl - Type : ACT_GATHER_INFO |
2014-10-17 | Name : The remote host is missing a Mac OS X update that fixes multiple vulnerabilit... File : macosx_10_10.nasl - Type : ACT_GATHER_INFO |
2014-10-17 | Name : The remote host is missing a Mac OS X update that fixes multiple security iss... File : macosx_SecUpd2014-005.nasl - Type : ACT_GATHER_INFO |
2014-10-16 | Name : The remote host has a virtualization appliance installed that is affected by ... File : vmware_vcenter_server_appliance_vmsa-2014-0010.nasl - Type : ACT_GATHER_INFO |
2014-10-13 | Name : A system shell on the remote host is vulnerable to command injection. File : bash_cve_2014_7169.nasl - Type : ACT_ATTACK |
2014-10-13 | Name : The remote Solaris system is missing a security patch for third party software. File : solaris11_bash_2014_10_07.nasl - Type : ACT_GATHER_INFO |
2014-10-12 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-418.nasl - Type : ACT_GATHER_INFO |
2014-10-12 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-419.nasl - Type : ACT_GATHER_INFO |
2014-10-11 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2380-1.nasl - Type : ACT_GATHER_INFO |
2014-10-10 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL15629.nasl - Type : ACT_GATHER_INFO |
2014-10-10 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-567.nasl - Type : ACT_GATHER_INFO |
2014-10-10 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2014-0021.nasl - Type : ACT_GATHER_INFO |
2014-10-10 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2014-0022.nasl - Type : ACT_GATHER_INFO |
2014-10-10 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2014-0024.nasl - Type : ACT_GATHER_INFO |
2014-10-09 | Name : The remote host is missing Sun Security Patch number 149079-03 File : solaris9_149079.nasl - Type : ACT_GATHER_INFO |
2014-10-09 | Name : The remote host is missing Sun Security Patch number 149080-02 File : solaris9_x86_149080.nasl - Type : ACT_GATHER_INFO |
2014-10-06 | Name : A system shell on the remote host is vulnerable to command injection. File : bash_remote_code_execution2.nasl - Type : ACT_DESTRUCTIVE_ATTACK |
2014-10-06 | Name : The remote Fedora host is missing a security update. File : fedora_2014-12202.nasl - Type : ACT_GATHER_INFO |
2014-10-06 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201409-09.nasl - Type : ACT_GATHER_INFO |
2014-10-06 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201410-01.nasl - Type : ACT_GATHER_INFO |
2014-10-03 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_81e2b3084a6c11e4b7116805ca0b3d42.nasl - Type : ACT_GATHER_INFO |
2014-10-02 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_512d130149b911e4ae2cc80aa9043978.nasl - Type : ACT_GATHER_INFO |
2014-10-02 | Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2014-0010.nasl - Type : ACT_GATHER_INFO |
2014-10-01 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_4a4e9f88491c11e4ae2cc80aa9043978.nasl - Type : ACT_GATHER_INFO |
2014-09-30 | Name : The remote host is is affected by a remote code execution vulnerability, comm... File : macosx_shellshock_update.nasl - Type : ACT_GATHER_INFO |
2014-09-30 | Name : The remote FTP server is affected by a remote code execution vulnerability. File : proftpd_bash_injection.nasl - Type : ACT_ATTACK |
2014-09-29 | Name : The remote Fedora host is missing a security update. File : fedora_2014-11295.nasl - Type : ACT_GATHER_INFO |
2014-09-29 | Name : The remote Fedora host is missing a security update. File : fedora_2014-11514.nasl - Type : ACT_GATHER_INFO |
2014-09-29 | Name : The remote Fedora host is missing a security update. File : fedora_2014-11527.nasl - Type : ACT_GATHER_INFO |
2014-09-29 | Name : The remote Fedora host is missing a security update. File : fedora_2014-11718.nasl - Type : ACT_GATHER_INFO |
2014-09-29 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-190.nasl - Type : ACT_GATHER_INFO |
2014-09-29 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-563.nasl - Type : ACT_GATHER_INFO |
2014-09-29 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-564.nasl - Type : ACT_GATHER_INFO |
2014-09-29 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1306.nasl - Type : ACT_GATHER_INFO |
2014-09-29 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2014-3079.nasl - Type : ACT_GATHER_INFO |
2014-09-29 | Name : The remote mail server uses scripts that allow remote command execution via S... File : shellshock_postfix_filters.nasl - Type : ACT_ATTACK |
2014-09-29 | Name : The remote mail server allows remote command execution via Shellshock. File : shellshock_qmail.nasl - Type : ACT_ATTACK |
2014-09-29 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140926_bash_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2014-09-29 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_bash-140926.nasl - Type : ACT_GATHER_INFO |
2014-09-29 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2364-1.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote Fedora host is missing a security update. File : fedora_2014-11360.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote Fedora host is missing a security update. File : fedora_2014-11503.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140924_bash_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2014-268-01.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2014-268-02.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1306.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3035.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201409-10.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-3075.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-3076.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2014-3077.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2014-3078.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1306.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote host is missing Oracle Security Patch number 126546-06 File : solaris10_126546-06.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote host is missing Oracle Security Patch number 126547-06 File : solaris10_x86_126547-06.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote host is missing Oracle Security Patch number 149079-01 File : solaris9_149079-01.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote host is missing Oracle Security Patch number 149080-01 File : solaris9_x86_149080-01.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2363-1.nasl - Type : ACT_GATHER_INFO |
2014-09-26 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2363-2.nasl - Type : ACT_GATHER_INFO |
2014-09-25 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2014-267-01.nasl - Type : ACT_GATHER_INFO |
2014-09-25 | Name : A system shell on the remote host is vulnerable to command injection. File : bash_remote_code_execution_telnet.nasl - Type : ACT_ATTACK |
2014-09-25 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1293.nasl - Type : ACT_GATHER_INFO |
2014-09-25 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3032.nasl - Type : ACT_GATHER_INFO |
2014-09-25 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_71ad81da441411e4a33e3c970e169bc2.nasl - Type : ACT_GATHER_INFO |
2014-09-25 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-186.nasl - Type : ACT_GATHER_INFO |
2014-09-25 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-559.nasl - Type : ACT_GATHER_INFO |
2014-09-25 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1293.nasl - Type : ACT_GATHER_INFO |
2014-09-25 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2014-1294.nasl - Type : ACT_GATHER_INFO |
2014-09-25 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1293.nasl - Type : ACT_GATHER_INFO |
2014-09-25 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_bash-140919.nasl - Type : ACT_GATHER_INFO |
2014-09-25 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2362-1.nasl - Type : ACT_GATHER_INFO |
2014-09-24 | Name : The remote web server is affected by a remote code execution vulnerability. File : bash_cve_2014_6271_rce.nasl - Type : ACT_ATTACK |
2014-09-24 | Name : A system shell on the remote host is vulnerable to command injection. File : bash_remote_code_execution.nasl - Type : ACT_ATTACK |
2012-09-26 | Name : The remote host is missing Sun Security Patch number 126546-10 File : solaris10_126546.nasl - Type : ACT_GATHER_INFO |
2012-09-17 | Name : The remote host is missing Sun Security Patch number 126547-10 File : solaris10_x86_126547.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2015-03-31 13:29:47 |
|
2015-03-29 21:25:05 |
|