Swapping Florian's unofficial patches for those released by bash upstream.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2014-553:01 advisory.

    Description :
    The GNU Bourne Again shell (Bash) is a shell or command language     interpreter that is compatible with the Bourne shell (sh). Bash     incorporates useful features from the Korn shell (ksh) and the C shell     (csh). Most sh scripts can be run by bash without modification. This     package (bash) contains bash version 3.2, which improves POSIX     compliance over previous versions.
    Security issues fixed with this release:
    CVE-2014-7169     GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in     the values of environment variables, which allows remote attackers to write to files or possibly have     unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand     feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by     unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege     boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for     CVE-2014-6271.
    CVE-2014-6271     GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment     variables, which allows remote attackers to execute arbitrary code via a crafted environment, as     demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid     modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in     which setting the environment occurs across a privilege boundary from Bash execution, aka ShellShock.
    NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the     vulnerability that is still present after the incorrect fix.
    CVE-2014-7186
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.
    CVE-2014-7187
    ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when     announcing a new security problem. When the candidate has been publicized, the details for this candidate     will be provided.
    Please see below CVE's link for more information.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was found that the fix for CVE-2014-6271 was incomplete, and Bash still allowed certain characters to be injected into other environments via specially crafted environment variables. An attacker could potentially use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue.
(CVE-2014-7169)

Applications which directly create bash functions as environment variables need to be made aware of changes to the way names are handled by this update.

Note: Docker users are advised to use 'yum update' within their containers, and to commit the resulting changes.

For additional information on CVE-2014-6271 and CVE-2014-7169, refer to https://securityblog.redhat.com/2014/09/24/bash-specially crafted-environment-variables-code-injection-attack/

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.

The remote host is running a version of Mac OS X 10.8 or 10.9 that does not have Security Update 2014-005 applied. This update contains several security-related fixes for the following issues :

  - A command injection vulnerability in GNU Bash known as     Shellshock. The vulnerability is due to the processing     of trailing strings after function definitions in the     values of environment variables. This allows a remote     attacker to execute arbitrary code via environment     variable manipulation depending on the configuration of     the system. (CVE-2014-6271, CVE-2014-7169)

  - A man-in-the-middle (MitM) information disclosure     vulnerability known as POODLE. The vulnerability is due     to the way SSL 3.0 handles padding bytes when decrypting     messages encrypted using block ciphers in cipher block     chaining (CBC) mode. A MitM attacker can decrypt a     selected byte of a cipher text in as few as 256 tries if     they are able to force a victim application to     repeatedly send the same data over newly created SSL 3.0     connections. (CVE-2014-3566)

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to its self-reported version, the remote NX-OS device is affected by a command injection vulnerability in GNU Bash known as Shellshock, which is due to the processing of trailing strings after function definitions in the values of environment variables. This allows a remote attacker to execute arbitrary code via environment variable manipulation depending on the configuration of the system.

The remote host appears to be running a mail transfer or mail delivery agent such as Courier, Exim, Postfix, or Procmail. Many of these agents can be configured to run utility scripts for a diverse number of tasks including filtering, sorting, and delivering mail. These scripts may create the conditions that are exploitable, making the agent vulnerable to remote code execution via Shellshock.

A negative result from this plugin does not prove conclusively that the remote system is not affected by Shellshock, only that the mail agent running on the system is not configured in such a way to allow remote execution via Shellshock.

According to its self-reported version, the remote host is running a version of Cisco UCS Director that could be affected by a command injection vulnerability in GNU Bash known as Shellshock, which is due to the processing of trailing strings after function definitions in the values of environment variables. This allows a remote attacker to execute arbitrary code via environment variable manipulation depending on the configuration of the system.

Authentication on the system is required before this vulnerability can be exploited.

The version of VMware NSX installed on the remote host is 4.x prior to 4.0.5 / 4.1.4 / 4.2.1 or 6.x prior to 6.0.7 / 6.1.1. It is, therefore, affected by a command injection vulnerability in GNU Bash known as Shellshock, which is due to the processing of trailing strings after function definitions in the values of environment variables. This allows a remote attacker to execute arbitrary code via environment variable manipulation depending on the configuration of the system.

The version of VMware Workspace Portal (formerly known as VMware Horizon Workspace) installed on the remote host is missing package updates. It is, therefore, affected by the following vulnerabilities in the Bash shell :

  - A command injection vulnerability exists in GNU Bash     known as Shellshock, which is due to the processing of     trailing strings after function definitions in the     values of environment variables. This allows a remote     attacker to execute arbitrary code via environment     variable manipulation depending on the configuration of     the system. By sending a specially crafted request to a     CGI script that passes environment variables, a remote,     unauthenticated attacker can execute arbitrary code on     the host. (CVE-2014-6271, CVE-2014-6277, CVE-2014-6278,     CVE-2014-7169)

  - An out-of-bounds memory access error exists due to     improper redirection implementation in the 'parse.y'     source file. A remote attacker can exploit this issue     to cause a denial of service or potentially execute     arbitrary code. (CVE-2014-7186)

  - An off-by-one error exists in the 'read_token_word'     function in the 'parse.y' source file. A remote attacker     can exploit this issue to cause a denial of service or     potentially execute arbitrary code. (CVE-2014-7187)

The version of VMware vCenter Operations Manager installed on the remote host is prior to 5.7.3 / 5.8.3. It is, therefore, affected by the environmental variable command injection vulnerability known as 'Shellshock'.

An updated rhev-hypervisor6 package that fixes several security issues is now available.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: a subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent.

Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions.

A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue.
(CVE-2014-6271)

It was found that the fix for CVE-2014-6271 was incomplete, and Bash still allowed certain characters to be injected into other environments via specially crafted environment variables. An attacker could potentially use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue.
(CVE-2014-7169)

A flaw was found in the way NSS parsed ASN.1 (Abstract Syntax Notation One) input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS. (CVE-2014-1568)

It was discovered that the fixed-sized redir_stack could be forced to overflow in the Bash parser, resulting in memory corruption, and possibly leading to arbitrary code execution when evaluating untrusted input that would not otherwise be run as code. (CVE-2014-7186)

An off-by-one error was discovered in the way Bash was handling deeply nested flow control constructs. Depending on the layout of the .bss segment, this could allow arbitrary execution of code that would not otherwise be executed by Bash. (CVE-2014-7187)

Red Hat would like to thank Stephane Chazelas for reporting CVE-2014-6271, and the Mozilla project for reporting CVE-2014-1568.
Upstream acknowledges Antoine Delignat-Lavaud and Intel Product Security Incident Response Team as the original reporters of CVE-2014-1568. The CVE-2014-7186 and CVE-2014-7187 issues were discovered by Florian Weimer of Red Hat Product Security.

Users of the Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package.

The remote host has a version of McAfee Web Gateway (MWG) installed that is affected by a command injection vulnerability in GNU Bash known as Shellshock. The vulnerability is due to the processing of trailing strings after function definitions in the values of environment variables. This allows a remote attacker to execute arbitrary code via environment variable manipulation depending on the configuration of the system.

According to its self-reported version number, remote Cisco TelePresence Conductor device is affected by a command injection vulnerability in GNU Bash known as Shellshock. The vulnerability is due to the processing of trailing strings after function definitions in the values of environment variables. This allows a remote attacker to execute arbitrary code via environment variable manipulation depending on the configuration of the system.

Note that an attacker must be authenticated before the device is exposed to this exploit.

According to its self-reported version number, the remote Junos Space version is prior to 14.1R2, and may be affected by a command injection vulnerability in GNU Bash known as Shellshock. The vulnerability is due to the processing of trailing strings after function definitions in the values of environment variables. This allows a remote attacker to execute arbitrary code via environment variable manipulation depending on the configuration of the system.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
78058	Fedora 20 : bash-4.2.51-2.fc20 (2014-12202)	Nessus	Fedora Local Security Checks	2014/10/6	2022/1/31	critical
289649	MiracleLinux 3 : bash-3.2-33.AXS3.4 (AXSA:2014-553:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/17	critical
77956	Scientific Linux Security Update : bash on SL5.x, SL6.x i386/x86_64 (20140926) (Shellshock)	Nessus	Scientific Linux Local Security Checks	2014/9/29	2022/12/5	critical
78197	F5 Networks BIG-IP : Multiple GNU Bash vulnerabilities (SOL15629) (Shellshock)	Nessus	F5 Networks Local Security Checks	2014/10/10	2025/10/3	critical
78551	Mac OS X Multiple Vulnerabilities (Security Update 2014-005) (POODLE) (Shellshock)	Nessus	MacOS X Local Security Checks	2014/10/17	2024/5/28	critical
78693	Cisco NX-OS GNU Bash Environment Variable Command Injection Vulnerability (cisco-sa-20140926-bash) (Shellshock)	Nessus	CISCO	2014/10/27	2025/10/3	critical
78701	Mail Transfer Agent and Mail Delivery Agent Remote Command Execution via Shellshock	Nessus	SMTP problems	2014/10/28	2022/12/5	critical
78770	Cisco UCS Director Code Injection (CSCur02877) (Shellshock)	Nessus	CISCO	2014/10/31	2025/10/3	critical
78826	VMware NSX Bash Environment Variable Command Injection (VMSA-2014-0010) (Shellshock)	Nessus	Misc.	2014/11/3	2025/10/3	critical
78857	VMware Workspace Portal Multiple Bash Shell Vulnerabilities (VMSA-2014-0010) (Shellshock)	Nessus	Misc.	2014/11/4	2025/10/3	critical
78889	VMware vCenter Operations Management Bash Vulnerabilities (VMSA-2014-0010) (Shellshock)	Nessus	Misc.	2014/11/6	2025/10/3	critical
79053	RHEL 6 : rhev-hypervisor6 (RHSA-2014:1354) (Shellshock)	Nessus	Red Hat Local Security Checks	2014/11/8	2023/4/25	critical
79215	McAfee Web Gateway GNU Bash Code Injection (SB10085) (Shellshock)	Nessus	Misc.	2014/11/12	2025/10/3	critical
79584	Cisco TelePresence Conductor Bash Remote Code Execution (Shellshock)	Nessus	CISCO	2014/11/26	2025/10/3	critical
80196	Juniper Junos Space GNU Bash Command Injection Vulnerability (JSA10648) (Shellshock)	Nessus	Junos Local Security Checks	2014/12/22	2025/10/3	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical