Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title bash Shift_JIS security update
Informations
Name RHSA-2014:1865 First vendor Publication 2014-11-17
Vendor RedHat Last vendor Modification 2014-11-17
Severity (Vendor) Important Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated bash Shift_JIS packages that fix one security issue are now available for Red Hat Enterprise Linux 5.9 Extended Update Support.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

2. Relevant releases/architectures:

SJIS (v. 5.9.z Server) - i386, ia64, x86_64

3. Description:

The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux.

Shift_JIS, also known as "SJIS", is a character encoding for the Japanese language. This package provides bash support for the Shift_JIS encoding.

It was found that the fix for CVE-2014-6271 was incomplete, and Bash still allowed certain characters to be injected into other environments via specially crafted environment variables. An attacker could potentially use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. (CVE-2014-7169)

Applications which directly create bash functions as environment variables need to be made aware of changes to the way names are handled by this update. Note that certain services, screen sessions, and tmux sessions may need to be restarted, and affected interactive users may need to re-login. Installing these updated packages without restarting services will address the vulnerability, but functionality may be impacted until affected services are restarted. For more information see the Knowledgebase article at https://access.redhat.com/articles/1200223

Note: Docker users are advised to use "yum update" within their containers, and to commit the resulting changes.

For additional information on CVE-2014-6271 and CVE-2014-7169, refer to the aforementioned Knowledgebase article.

All users who require Shift_JIS encoding support with Bash built-in functions are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1146319 - CVE-2014-7169 bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2014-1865.html

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
50 % CWE-78 Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:26290
 
Oval ID: oval:org.mitre.oval:def:26290
Title: USN-2363-1 -- bash vulnerability
Description: Bash allowed bypassing environment restrictions in certain environments.
Family: unix Class: patch
Reference(s): USN-2363-1
CVE-2014-7169
Version: 3
Platform(s): Ubuntu 14.04
Ubuntu 12.04
Ubuntu 10.04
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26447
 
Oval ID: oval:org.mitre.oval:def:26447
Title: Vulnerability affecting GNU Bash
Description: GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
Family: unix Class: vulnerability
Reference(s): CVE-2014-7169
Version: 4
Platform(s): Sun Solaris 10
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26521
 
Oval ID: oval:org.mitre.oval:def:26521
Title: RHSA-2014:1293: bash security update (Critical)
Description: The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux. A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. (CVE-2014-6271) For additional information on the CVE-2014-6271 flaw, refer to the Knowledgebase article at https://access.redhat.com/articles/1200223 Red Hat would like to thank Stephane Chazelas for reporting this issue. All bash users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.
Family: unix Class: patch
Reference(s): RHSA-2014:1293-00
CESA-2014:1293
CVE-2014-6271
Version: 3
Platform(s): Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 7
CentOS Linux 5
CentOS Linux 6
CentOS Linux 7
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26539
 
Oval ID: oval:org.mitre.oval:def:26539
Title: USN-2362-1 -- bash vulnerability
Description: Bash allowed bypassing environment restrictions in certain environments.
Family: unix Class: patch
Reference(s): USN-2362-1
CVE-2014-6271
Version: 3
Platform(s): Ubuntu 14.04
Ubuntu 12.04
Ubuntu 10.04
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26555
 
Oval ID: oval:org.mitre.oval:def:26555
Title: ELSA-2014-3075 -- bash security update (Critical)
Description: [4.1.2-15.1.0.1] - Preliminary fix for CVE-2014-7169
Family: unix Class: patch
Reference(s): ELSA-2014-3075
CVE-2014-7169
Version: 3
Platform(s): Oracle Linux 6
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26589
 
Oval ID: oval:org.mitre.oval:def:26589
Title: RHSA-2014:1306: bash security update (Important)
Description: The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux. It was found that the fix for CVE-2014-6271 was incomplete, and Bash still allowed certain characters to be injected into other environments via specially crafted environment variables. An attacker could potentially use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. (CVE-2014-7169) Applications which directly create bash functions as environment variables need to be made aware of changes to the way names are handled by this update. For more information see the Knowledgebase article at https://access.redhat.com/articles/1200223 Note: Docker users are advised to use "yum update" within their containers, and to commit the resulting changes. For additional information on CVE-2014-6271 and CVE-2014-7169, refer to the aforementioned Knowledgebase article. All bash users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.
Family: unix Class: patch
Reference(s): RHSA-2014:1306-00
CESA-2014:1306
CVE-2014-7169
Version: 3
Platform(s): Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat Enterprise Linux 5
CentOS Linux 5
CentOS Linux 6
CentOS Linux 7
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26614
 
Oval ID: oval:org.mitre.oval:def:26614
Title: ELSA-2014-3077 -- bash security update (Critical)
Description: [3.2-33.1.0.1] - Preliminary fix for CVE-2014-7169
Family: unix Class: patch
Reference(s): ELSA-2014-3077
CVE-2014-7169
Version: 3
Platform(s): Oracle Linux 5
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26615
 
Oval ID: oval:org.mitre.oval:def:26615
Title: ELSA-2014-3076 -- bash security update (Critical)
Description: [4.2.45-5.2.0.1] - Preliminary fix for CVE-2014-7169
Family: unix Class: patch
Reference(s): ELSA-2014-3076
CVE-2014-7169
Version: 3
Platform(s): Oracle Linux 7
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26631
 
Oval ID: oval:org.mitre.oval:def:26631
Title: SUSE-SU-2014:1247-1 -- Security update for bash
Description: The command-line shell 'bash' evaluates environment variables, which allows the injection of characters and might be used to access files on the system in some circumstances (CVE-2014-7169). Please note that this issue is different from a previously fixed vulnerability tracked under CVE-2014-6271 and is less serious due to the special, non-default system configuration that is needed to create an exploitable situation. To remove further exploitation potential we now limit the function-in-environment variable to variables prefixed with BASH_FUNC_. This hardening feature is work in progress and might be improved in later updates. Additionally, two other security issues have been fixed: * CVE-2014-7186: Nested HERE documents could lead to a crash of bash. * CVE-2014-7187: Nesting of for loops could lead to a crash of bash. Security Issues: * CVE-2014-7169 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7169> * CVE-2014-7186 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186> * CVE-2014-7187 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187>
Family: unix Class: patch
Reference(s): SUSE-SU-2014:1247-1
CVE-2014-7169
CVE-2014-6271
CVE-2014-7186
CVE-2014-7187
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Server 10
SUSE Linux Enterprise Desktop 11
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26642
 
Oval ID: oval:org.mitre.oval:def:26642
Title: DSA-3032-1 bash - security update
Description: Stephane Chazelas discovered a vulnerability in bash, the GNU Bourne-Again Shell, related to how environment variables are processed. In many common configurations, this vulnerability is exploitable over the network, especially if bash has been configured as the system shell.
Family: unix Class: patch
Reference(s): DSA-3032-1
CVE-2014-6271
Version: 3
Platform(s): Debian GNU/Linux 7.0
Debian GNU/kFreeBSD 7.0
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26665
 
Oval ID: oval:org.mitre.oval:def:26665
Title: DSA-3035-1 bash - security update
Description: Tavis Ormandy discovered that the patch applied to fix <a href="https://security-tracker.debian.org/tracker/CVE-2014-6271">CVE-2014-6271</a> released in DSA-3032-1 for bash, the GNU Bourne-Again Shell, was incomplete and could still allow some characters to be injected into another environment (<a href="https://security-tracker.debian.org/tracker/CVE-2014-7169">CVE-2014-7169</a>). With this update prefix and suffix for environment variable names which contain shell functions are added as hardening measure.
Family: unix Class: patch
Reference(s): DSA-3035-1
CVE-2014-7169
CVE-2014-6271
Version: 3
Platform(s): Debian GNU/Linux 7.0
Debian GNU/kFreeBSD 7.0
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26685
 
Oval ID: oval:org.mitre.oval:def:26685
Title: ELSA-2014-1294 -- bash security update (Critical)
Description: The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux. A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. (CVE-2014-6271) For additional information on the CVE-2014-6271 flaw, refer to the Knowledgebase article at <A HREF="https://access.redhat.com/articles/1200223">https://access.redhat.com/articles/1200223</A> Red Hat would like to thank Stephane Chazelas for reporting this issue. All bash users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.
Family: unix Class: patch
Reference(s): ELSA-2014-1294
CVE-2014-6271
Version: 3
Platform(s): Oracle Linux 4
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26712
 
Oval ID: oval:org.mitre.oval:def:26712
Title: ELSA-2014-3078 -- bash security update (Critical)
Description: [3.0-27.0.2] - Preliminary fix for CVE-2014-7169
Family: unix Class: patch
Reference(s): ELSA-2014-3078
CVE-2014-7169
Version: 3
Platform(s): Oracle Linux 4
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26745
 
Oval ID: oval:org.mitre.oval:def:26745
Title: USN-2363-2 -- bash vulnerability
Description: Bash allowed bypassing environment restrictions in certain environments.
Family: unix Class: patch
Reference(s): USN-2363-2
CVE-2014-7169
Version: 3
Platform(s): Ubuntu 14.04
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26764
 
Oval ID: oval:org.mitre.oval:def:26764
Title: Vulnerability affecting GNU Bash
Description: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
Family: unix Class: vulnerability
Reference(s): CVE-2014-6271
Version: 4
Platform(s): Sun Solaris 10
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26923
 
Oval ID: oval:org.mitre.oval:def:26923
Title: ELSA-2014-1293 -- bash security update (Critical)
Description: The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux. A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. (CVE-2014-6271) For additional information on the CVE-2014-6271 flaw, refer to the Knowledgebase article at <A HREF="https://access.redhat.com/articles/1200223">https://access.redhat.com/articles/1200223</A> Red Hat would like to thank Stephane Chazelas for reporting this issue. All bash users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.
Family: unix Class: patch
Reference(s): ELSA-2014-1293
CVE-2014-6271
Version: 3
Platform(s): Oracle Linux 6
Oracle Linux 7
Oracle Linux 5
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26928
 
Oval ID: oval:org.mitre.oval:def:26928
Title: ELSA-2014-3079 -- bash security update (Important)
Description: [3.0-27.0.3] - Rework env function definition for safety (Florian Weimer) [CVE-2014-7169]
Family: unix Class: patch
Reference(s): ELSA-2014-3079
CVE-2014-7169
Version: 3
Platform(s): Oracle Linux 4
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27118
 
Oval ID: oval:org.mitre.oval:def:27118
Title: ELSA-2014-1306 -- bash security update (Important)
Description: The GNU Bourne Again shell (Bash) is a shell and command language interpreter compatible with the Bourne shell (sh). Bash is the default shell for Red Hat Enterprise Linux. It was found that the fix for CVE-2014-6271 was incomplete, and Bash still allowed certain characters to be injected into other environments via specially crafted environment variables. An attacker could potentially use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue. (CVE-2014-7169) Applications which directly create bash functions as environment variables need to be made aware of changes to the way names are handled by this update. Note that certain services, screen sessions, and tmux sessions may need to be restarted, and affected interactive users may need to re-login. Installing these updated packages without restarting services will address the vulnerability, but functionality may be impacted until affected services are restarted. For more information see the Knowledgebase article at <A HREF="https://access.redhat.com/articles/1200223">https://access.redhat.com/articles/1200223</A> Note: Docker users are advised to use &quot;yum update&quot; within their containers, and to commit the resulting changes. For additional information on CVE-2014-6271 and CVE-2014-7169, refer to the aforementioned Knowledgebase article. All bash users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.
Family: unix Class: patch
Reference(s): ELSA-2014-1306
CVE-2014-7169
CVE-2014-7186
CVE-2014-7187
CVE-2014-6271
Version: 3
Platform(s): Oracle Linux 7
Oracle Linux 6
Oracle Linux 5
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27163
 
Oval ID: oval:org.mitre.oval:def:27163
Title: USN-2364-1 -- bash vulnerabilities
Description: Several security issues were fixed in Bash.
Family: unix Class: patch
Reference(s): USN-2364-1
CVE-2014-7186
CVE-2014-7187
Version: 3
Platform(s): Ubuntu 14.04
Ubuntu 12.04
Ubuntu 10.04
Product(s): bash
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27830
 
Oval ID: oval:org.mitre.oval:def:27830
Title: SUSE-SU-2014:1260-1 -- bash (critical)
Description: Bash was updated to fix unexpected code execution with environment variables (CVE-2014-6271).
Family: unix Class: patch
Reference(s): SUSE-SU-2014:1260-1
CVE-2014-6271
Version: 3
Platform(s): SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 12
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27981
 
Oval ID: oval:org.mitre.oval:def:27981
Title: SUSE-SU-2014:1259-1 -- bash (important)
Description: The command-line shell 'bash' evaluates environment variables, which allows the injection of characters and might be used to access files on the system in some circumstances (CVE-2014-7169). Please note that this issue is different from a previously fixed vulnerability tracked under CVE-2014-6271 and it is less serious due to the special, non-default system configuration that is needed to create an exploitable situation. To remove further exploitation potential we now limit the function-in-environment variable to variables prefixed with BASH_FUNC_ . This hardening feature is work in progress and might be improved in later updates. Additionaly two more security issues were fixed in bash: CVE-2014-7186: Nested HERE documents could lead to a crash of bash. CVE-2014-7187: Nesting of for loops could lead to a crash of bash.
Family: unix Class: patch
Reference(s): SUSE-SU-2014:1259-1
CVE-2014-7169
CVE-2014-6271
CVE-2014-7186
CVE-2014-7187
Version: 3
Platform(s): SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Desktop 12
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28062
 
Oval ID: oval:org.mitre.oval:def:28062
Title: VMware product updates address critical Bash security vulnerabilities
Description: GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
Family: unix Class: vulnerability
Reference(s): CVE-2014-7169
Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28319
 
Oval ID: oval:org.mitre.oval:def:28319
Title: VMware product updates address critical Bash security vulnerabilities
Description: The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2014-7186
Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28331
 
Oval ID: oval:org.mitre.oval:def:28331
Title: VMware product updates address critical Bash security vulnerabilities
Description: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
Family: unix Class: vulnerability
Reference(s): CVE-2014-6271
Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28370
 
Oval ID: oval:org.mitre.oval:def:28370
Title: VMware product updates address critical Bash security vulnerabilities
Description: Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.
Family: unix Class: vulnerability
Reference(s): CVE-2014-7187
Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 28

SAINT Exploits

Description Link
Bash environment variable code injection over HTTP More info here
Bash Environment Variable Handling Shell Command Injection Via CUPS More info here
ShellShock DHCP Server More info here

ExploitDB Exploits

id Description
2014-11-03 PHP 5.x Shellshock Exploit (bypass disable_functions)
2014-10-29 CUPS Filter Bash Environment Variable Code Injection
2014-10-04 OpenVPN 2.2.29 - ShellShock Exploit
2014-10-02 GNU bash 4.3.11 Environment Variable dhclient Exploit
2014-10-01 IPFire Cgi Web Interface Authenticated Bash Environment Variable Code Injecti...
2014-09-25 GNU bash Environment Variable Command Injection (MSF)

Information Assurance Vulnerability Management (IAVM)

Date Description
2014-09-25 IAVM : 2014-A-0142 - GNU Bash Shell Code Execution Vulnerability
Severity : Category I - VMSKEY : V0054753

Snort® IPS/IDS

Date Description
2015-07-13 Linux.Trojan.ChinaZ outbound connection
RuleID : 34847 - Revision : 3 - Type : MALWARE-CNC
2014-10-30 Bash environment variable injection attempt
RuleID : 32366-community - Revision : 2 - Type : OS-OTHER
2014-12-02 Bash environment variable injection attempt
RuleID : 32366 - Revision : 2 - Type : OS-OTHER
2014-10-24 Bash CGI environment variable injection attempt
RuleID : 32336-community - Revision : 2 - Type : OS-OTHER
2014-11-25 Bash CGI environment variable injection attempt
RuleID : 32336 - Revision : 2 - Type : OS-OTHER
2014-10-24 Bash CGI environment variable injection attempt
RuleID : 32335-community - Revision : 2 - Type : OS-OTHER
2014-11-25 Bash CGI environment variable injection attempt
RuleID : 32335 - Revision : 2 - Type : OS-OTHER
2014-10-03 Bash environment variable injection attempt
RuleID : 32069-community - Revision : 3 - Type : OS-OTHER
2014-11-16 Bash environment variable injection attempt
RuleID : 32069 - Revision : 3 - Type : OS-OTHER
2014-11-16 Bash CGI nested loops word_lineno denial of service attempt
RuleID : 32049 - Revision : 2 - Type : OS-OTHER
2014-11-16 Bash CGI nested loops word_lineno denial of service attempt
RuleID : 32047 - Revision : 2 - Type : OS-OTHER
2014-11-16 Bash redir_stack here document handling denial of service attempt
RuleID : 32046 - Revision : 2 - Type : OS-OTHER
2014-11-16 Bash redir_stack here document handling denial of service attempt
RuleID : 32045 - Revision : 2 - Type : OS-OTHER
2014-10-01 Bash environment variable injection attempt
RuleID : 32043-community - Revision : 3 - Type : OS-OTHER
2014-11-16 Bash environment variable injection attempt
RuleID : 32043 - Revision : 3 - Type : OS-OTHER
2014-10-01 Bash environment variable injection attempt
RuleID : 32042-community - Revision : 4 - Type : OS-OTHER
2014-11-16 Bash environment variable injection attempt
RuleID : 32042 - Revision : 4 - Type : OS-OTHER
2014-10-01 Bash environment variable injection attempt
RuleID : 32041-community - Revision : 4 - Type : OS-OTHER
2014-11-16 Bash environment variable injection attempt
RuleID : 32041 - Revision : 4 - Type : OS-OTHER
2014-10-01 Bash environment variable injection attempt
RuleID : 32039-community - Revision : 3 - Type : OS-OTHER
2014-11-16 Bash environment variable injection attempt
RuleID : 32039 - Revision : 3 - Type : OS-OTHER
2014-10-01 Bash environment variable injection attempt
RuleID : 32038-community - Revision : 3 - Type : OS-OTHER
2014-11-16 Bash environment variable injection attempt
RuleID : 32038 - Revision : 3 - Type : OS-OTHER
2014-09-25 Malicious DHCP server bash environment variable injection attempt
RuleID : 31985-community - Revision : 6 - Type : OS-OTHER
2014-11-16 Malicious DHCP server bash environment variable injection attempt
RuleID : 31985 - Revision : 6 - Type : OS-OTHER
2014-09-25 Bash CGI environment variable injection attempt
RuleID : 31978-community - Revision : 5 - Type : OS-OTHER
2014-11-16 Bash CGI environment variable injection attempt
RuleID : 31978 - Revision : 5 - Type : OS-OTHER
2014-09-25 Bash CGI environment variable injection attempt
RuleID : 31977-community - Revision : 5 - Type : OS-OTHER
2014-11-16 Bash CGI environment variable injection attempt
RuleID : 31977 - Revision : 5 - Type : OS-OTHER
2014-09-25 Bash CGI environment variable injection attempt
RuleID : 31976-community - Revision : 5 - Type : OS-OTHER
2014-11-16 Bash CGI environment variable injection attempt
RuleID : 31976 - Revision : 5 - Type : OS-OTHER
2014-09-25 Bash CGI environment variable injection attempt
RuleID : 31975-community - Revision : 6 - Type : OS-OTHER
2014-11-16 Bash CGI environment variable injection attempt
RuleID : 31975 - Revision : 6 - Type : OS-OTHER

Nessus® Vulnerability Scanner

Date Description
2017-12-04 Name : The remote host is missing a vendor-supplied security patch.
File : check_point_gaia_sk102673.nasl - Type : ACT_GATHER_INFO
2017-03-30 Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2017-0050.nasl - Type : ACT_GATHER_INFO
2016-02-02 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_bash_20141031_2.nasl - Type : ACT_GATHER_INFO
2015-12-30 Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2014-0010_remote.nasl - Type : ACT_GATHER_INFO
2015-10-05 Name : The remote host is missing a Mac OS X update that fixes multiple security vul...
File : macosx_10_11.nasl - Type : ACT_GATHER_INFO
2015-08-25 Name : The remote IBM Storwize V7000 Unified device is affected by multiple vulnerab...
File : ibm_storwize_1_5_0_4.nasl - Type : ACT_GATHER_INFO
2015-04-06 Name : The remote web server is affected by a remote code execution vulnerability.
File : bash_cve_2014_6278.nasl - Type : ACT_ATTACK
2015-03-30 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2015-164.nasl - Type : ACT_GATHER_INFO
2015-03-26 Name : The remote Debian host is missing a security update.
File : debian_DLA-63.nasl - Type : ACT_GATHER_INFO
2015-01-29 Name : The remote host is missing a Mac OS X update that fixes multiple vulnerabilit...
File : macosx_10_10_2.nasl - Type : ACT_GATHER_INFO
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_bash_20141031.nasl - Type : ACT_GATHER_INFO
2014-12-22 Name : The remote device is affected by multiple vulnerabilities.
File : juniper_space_jsa10648.nasl - Type : ACT_GATHER_INFO
2014-11-26 Name : The remote Cisco TelePresence Conductor device is affected by a command injec...
File : cisco_telepresence_conductor_CSCur02103.nasl - Type : ACT_GATHER_INFO
2014-11-13 Name : The remote host is affected by a code injection vulnerability known as Shells...
File : mcafee_ngfw_SB10085.nasl - Type : ACT_GATHER_INFO
2014-11-12 Name : The remote host is affected by a code injection vulnerability known as Shells...
File : mcafee_web_gateway_sb10085.nasl - Type : ACT_GATHER_INFO
2014-11-12 Name : The remote host has an application installed that is affected by multiple vul...
File : vmware_vcenter_converter_2014-0010.nasl - Type : ACT_GATHER_INFO
2014-11-11 Name : The remote host is missing a vendor-supplied security patch.
File : cisco_cups_CSCur05454.nasl - Type : ACT_GATHER_INFO
2014-11-11 Name : The remote host is affected by a code injection vulnerability known as Shells...
File : mcafee_email_gateway_SB10085.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1294.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1311.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2014-1354.nasl - Type : ACT_GATHER_INFO
2014-11-06 Name : The remote host has a virtualization appliance installed that is affected by ...
File : vcenter_operations_manager_vmsa_2014-0010.nasl - Type : ACT_GATHER_INFO
2014-11-04 Name : The remote host has a device management application installed that is affecte...
File : vmware_workspace_portal_vmsa2014-0010.nasl - Type : ACT_GATHER_INFO
2014-11-03 Name : The remote security device is missing a vendor-supplied security patch.
File : cisco-sa-CSCur01959-asa-cx.nasl - Type : ACT_GATHER_INFO
2014-11-03 Name : The management application installed on the remote host is affected by a comm...
File : cisco-sa-CSCur01959-prsm.nasl - Type : ACT_GATHER_INFO
2014-11-03 Name : The remote SIP server uses scripts that allow remote command execution via Sh...
File : shellshock_sip_invite.nasl - Type : ACT_ATTACK
2014-11-03 Name : The remote host is affected by a command injection vulnerability.
File : vmware_nsx_vmsa_2014_0010.nasl - Type : ACT_GATHER_INFO
2014-10-31 Name : The remote host is running a vulnerable version of Bash.
File : cisco_ucs_director_CSCur02877.nasl - Type : ACT_GATHER_INFO
2014-10-31 Name : The remote host has a virtualization appliance installed that is affected by ...
File : vmware_vsphere_replication_vmsa_2014_0010.nasl - Type : ACT_GATHER_INFO
2014-10-28 Name : The remote host has a mail agent installed that allows remote command executi...
File : shellshock_mail_agents.nasl - Type : ACT_DESTRUCTIVE_ATTACK
2014-10-27 Name : The remote device is running a version of NX-OS that is affected by Shellshock.
File : cisco-sa-20140926-bash-nxos.nasl - Type : ACT_GATHER_INFO
2014-10-21 Name : The version of Cisco TelePresence Video Communication Server installed on the...
File : cisco_telepresence_vcs_CSCur01461.nasl - Type : ACT_GATHER_INFO
2014-10-21 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-594.nasl - Type : ACT_GATHER_INFO
2014-10-21 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-595.nasl - Type : ACT_GATHER_INFO
2014-10-20 Name : The remote host is affected by a remote code execution vulnerability.
File : palo_alto_PAN-SA-2014-0004.nasl - Type : ACT_GATHER_INFO
2014-10-17 Name : The remote host is missing a Mac OS X update that fixes multiple vulnerabilit...
File : macosx_10_10.nasl - Type : ACT_GATHER_INFO
2014-10-17 Name : The remote host is missing a Mac OS X update that fixes multiple security iss...
File : macosx_SecUpd2014-005.nasl - Type : ACT_GATHER_INFO
2014-10-16 Name : The remote host has a virtualization appliance installed that is affected by ...
File : vmware_vcenter_server_appliance_vmsa-2014-0010.nasl - Type : ACT_GATHER_INFO
2014-10-13 Name : A system shell on the remote host is vulnerable to command injection.
File : bash_cve_2014_7169.nasl - Type : ACT_ATTACK
2014-10-13 Name : The remote Solaris system is missing a security patch for third party software.
File : solaris11_bash_2014_10_07.nasl - Type : ACT_GATHER_INFO
2014-10-12 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-418.nasl - Type : ACT_GATHER_INFO
2014-10-12 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-419.nasl - Type : ACT_GATHER_INFO
2014-10-10 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL15629.nasl - Type : ACT_GATHER_INFO
2014-10-10 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-567.nasl - Type : ACT_GATHER_INFO
2014-10-10 Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2014-0021.nasl - Type : ACT_GATHER_INFO
2014-10-10 Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2014-0022.nasl - Type : ACT_GATHER_INFO
2014-10-10 Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2014-0024.nasl - Type : ACT_GATHER_INFO
2014-10-09 Name : The remote host is missing Sun Security Patch number 149079-03
File : solaris9_149079.nasl - Type : ACT_GATHER_INFO
2014-10-09 Name : The remote host is missing Sun Security Patch number 149080-02
File : solaris9_x86_149080.nasl - Type : ACT_GATHER_INFO
2014-10-06 Name : The remote Fedora host is missing a security update.
File : fedora_2014-12202.nasl - Type : ACT_GATHER_INFO
2014-10-06 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201409-09.nasl - Type : ACT_GATHER_INFO
2014-10-06 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201410-01.nasl - Type : ACT_GATHER_INFO
2014-10-03 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_81e2b3084a6c11e4b7116805ca0b3d42.nasl - Type : ACT_GATHER_INFO
2014-10-02 Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2014-0010.nasl - Type : ACT_GATHER_INFO
2014-10-01 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_4a4e9f88491c11e4ae2cc80aa9043978.nasl - Type : ACT_GATHER_INFO
2014-09-30 Name : The remote host is is affected by a remote code execution vulnerability, comm...
File : macosx_shellshock_update.nasl - Type : ACT_GATHER_INFO
2014-09-30 Name : The remote FTP server is affected by a remote code execution vulnerability.
File : proftpd_bash_injection.nasl - Type : ACT_ATTACK
2014-09-29 Name : The remote Fedora host is missing a security update.
File : fedora_2014-11295.nasl - Type : ACT_GATHER_INFO
2014-09-29 Name : The remote Fedora host is missing a security update.
File : fedora_2014-11514.nasl - Type : ACT_GATHER_INFO
2014-09-29 Name : The remote Fedora host is missing a security update.
File : fedora_2014-11527.nasl - Type : ACT_GATHER_INFO
2014-09-29 Name : The remote Fedora host is missing a security update.
File : fedora_2014-11718.nasl - Type : ACT_GATHER_INFO
2014-09-29 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-190.nasl - Type : ACT_GATHER_INFO
2014-09-29 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-563.nasl - Type : ACT_GATHER_INFO
2014-09-29 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-564.nasl - Type : ACT_GATHER_INFO
2014-09-29 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-1306.nasl - Type : ACT_GATHER_INFO
2014-09-29 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2014-3079.nasl - Type : ACT_GATHER_INFO
2014-09-29 Name : The remote mail server uses scripts that allow remote command execution via S...
File : shellshock_postfix_filters.nasl - Type : ACT_ATTACK
2014-09-29 Name : The remote mail server allows remote command execution via Shellshock.
File : shellshock_qmail.nasl - Type : ACT_ATTACK
2014-09-29 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140926_bash_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-09-29 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_bash-140926.nasl - Type : ACT_GATHER_INFO
2014-09-29 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2364-1.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote Fedora host is missing a security update.
File : fedora_2014-11360.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote Fedora host is missing a security update.
File : fedora_2014-11503.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140924_bash_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2014-268-01.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2014-268-02.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1306.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3035.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201409-10.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-3075.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-3076.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2014-3077.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2014-3078.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1306.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote host is missing Oracle Security Patch number 126546-06
File : solaris10_126546-06.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote host is missing Oracle Security Patch number 126547-06
File : solaris10_x86_126547-06.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote host is missing Oracle Security Patch number 149079-01
File : solaris9_149079-01.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote host is missing Oracle Security Patch number 149080-01
File : solaris9_x86_149080-01.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2363-1.nasl - Type : ACT_GATHER_INFO
2014-09-26 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2363-2.nasl - Type : ACT_GATHER_INFO
2014-09-25 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2014-267-01.nasl - Type : ACT_GATHER_INFO
2014-09-25 Name : A system shell on the remote host is vulnerable to command injection.
File : bash_remote_code_execution_telnet.nasl - Type : ACT_ATTACK
2014-09-25 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1293.nasl - Type : ACT_GATHER_INFO
2014-09-25 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3032.nasl - Type : ACT_GATHER_INFO
2014-09-25 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_71ad81da441411e4a33e3c970e169bc2.nasl - Type : ACT_GATHER_INFO
2014-09-25 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-186.nasl - Type : ACT_GATHER_INFO
2014-09-25 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-559.nasl - Type : ACT_GATHER_INFO
2014-09-25 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-1293.nasl - Type : ACT_GATHER_INFO
2014-09-25 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2014-1294.nasl - Type : ACT_GATHER_INFO
2014-09-25 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1293.nasl - Type : ACT_GATHER_INFO
2014-09-25 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_bash-140919.nasl - Type : ACT_GATHER_INFO
2014-09-25 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2362-1.nasl - Type : ACT_GATHER_INFO
2014-09-24 Name : The remote web server is affected by a remote code execution vulnerability.
File : bash_cve_2014_6271_rce.nasl - Type : ACT_ATTACK
2014-09-24 Name : A system shell on the remote host is vulnerable to command injection.
File : bash_remote_code_execution.nasl - Type : ACT_ATTACK
2012-09-26 Name : The remote host is missing Sun Security Patch number 126546-10
File : solaris10_126546.nasl - Type : ACT_GATHER_INFO
2012-09-17 Name : The remote host is missing Sun Security Patch number 126547-10
File : solaris10_x86_126547.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-11-17 21:21:54
  • First insertion