Updated bash packages fix security vulnerability :

A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue (CVE-2014-6271).

This vulnerability can be exposed and exploited through several other pieces of software and should be considered highly critical. Please refer to the RedHat Knowledge Base article and blog post for more information.

It was found that the fix for CVE-2014-6271 was incomplete, and Bash still allowed certain characters to be injected into other environments via specially crafted environment variables. An attacker could potentially use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue (CVE-2014-7169).

Bash has been updated to version 4.2 patch level 50, which further mitigates ShellShock-type vulnerabilities. Two such issues have already been discovered (CVE-2014-6277, CVE-2014-6278).

See the RedHat article on the backward-incompatible changes introduced by the latest patch, caused by adding prefixes and suffixes to the variable names used for exporting functions. Note that the RedHat article mentions these variable names will have parentheses '()' at the end of their names, however, the latest upstream patch uses two percent signs '%%' at the end instead.

Two other unrelated security issues in the parser have also been fixed in this update (CVE-2014-7186, CVE-2014-7187).

All users and sysadmins are advised to update their bash package immediately.

The remote VMware ESX host is affected by multiple vulnerabilities in the Bash shell :

  - A command injection vulnerability exists in GNU Bash     known as Shellshock. The vulnerability is due to the     processing of trailing strings after function     definitions in the values of environment variables. This     allows a remote attacker to execute arbitrary code via     environment variable manipulation depending on the     configuration of the system. (CVE-2014-6271,     CVE-2014-7169, CVE-2014-6277, CVE-2014-6278)

  - A out-of-bounds read error exists in the redirection     implementation in file parse.y when evaluating     untrusted input during stacked redirects handling. A     remote attacker can exploit this to cause a denial of     service or possibly have other unspecified impact.
    (CVE-2014-7186)

  - An off-by-one overflow condition exists in the     read_token_word() function in file parse.y when handling     deeply nested flow control structures. A remote attacker     can exploit this, by using deeply nested for-loops, to     cause a denial of service or possibly execute arbitrary     code. (CVE-2014-7187)

The remote host is running a version of Palo Alto Networks PAN-OS prior to 5.0.15 / 5.1.10 / 6.0.6 / 6.1.1. It is, therefore, affected by a command injection vulnerability in GNU Bash known as Shellshock, which is due to the processing of trailing strings after function definitions in the values of environment variables. This allows a remote attacker to execute arbitrary code via environment variable manipulation depending on the configuration of the system.

According to its self-reported version number, the version of Cisco Prime Security Manager installed on the remote host is affected by a command injection vulnerability in GNU Bash known as Shellshock. The vulnerability is due to the processing of trailing strings after function definitions in the values of environment variables. This allows a remote attacker to execute arbitrary code via environment variable manipulation depending on the configuration of the system.

The version of VMware vCenter Converter installed on the remote Windows host is 5.1.x prior to 5.1.2 or 5.5.x prior to 5.5.3. It is, therefore, affected by the following vulnerabilities :

  - A command injection vulnerability exists in GNU Bash     known as Shellshock, which is due to the processing of     trailing strings after function definitions in the     values of environment variables. This allows a remote     attacker to execute arbitrary code via environment     variable manipulation depending on the configuration of     the system. While this host is not directly impacted by     Shellshock, the standalone Converter application does     deploy a Helper VM during Linux P2V conversions. This     Helper VM contains a vulnerable version of Bash.
    (CVE-2014-6271, CVE-2014-6277, CVE-2014-6278,     CVE-2014-7169, CVE-2014-7186, CVE-2014-7187)

  - A memory double-free error exists in 'd1_both.c' related     to handling DTLS packets that allows denial of service     attacks. (CVE-2014-3505)

  - An unspecified error exists in 'd1_both.c' related to     handling DTLS handshake messages that allows denial of     service attacks due to large amounts of memory being     consumed. (CVE-2014-3506)

  - A memory leak error exists in 'd1_both.c' related to     handling specially crafted DTLS packets that allows     denial of service attacks. (CVE-2014-3507)

  - A NULL pointer dereference error exists related to     handling anonymous ECDH cipher suites and crafted     handshake messages that allows denial of service attacks     against clients. (CVE-2014-3510)

The remote host is running a version of Bash that is vulnerable to command injection via environment variable manipulation. Depending on the configuration of the system, an attacker could remotely execute arbitrary code.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2014-3076 advisory.

    [4.2.45-5.2.0.1]
    - Preliminary fix for CVE-2014-7169

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Description of changes:

[3.0-27.0.2]
- Preliminary fix for CVE-2014-7169

This build should fix CVE-2014-7169

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 5 / 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1306 advisory.

    - CVE-2014-7169       Resolves: #1146324

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host appears to be running Postfix. Postfix itself is not vulnerable to Shellshock; however, any bash script Postfix runs for filtering or other tasks could potentially be affected if the script exports an environmental variable from the content or headers of a message.

A negative result from this plugin does not prove conclusively that the remote system is not affected by Shellshock, only that any scripts Postfix may be running do not create the conditions that are exploitable via the Shellshock flaw.

The remote Mac OS X host has a version of Bash prior to 3.2.53(1)-release installed. It is, therefore, affected by a command injection vulnerability via environment variable manipulation.
Depending on the configuration of the system, an attacker could remotely execute arbitrary code.

a. Bash update for multiple products.

   Bash libraries have been updated in multiple products to resolve    multiple critical security issues, also referred to as Shellshock.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the identifiers CVE-2014-6271, CVE-2014-7169,    CVE-2014-7186, and CVE-2014-7187, CVE-2014-6277, CVE-2014-6278    to these issues.

   VMware products have been grouped into the following four    product categories :
      I) ESXi and ESX Hypervisor    ESXi is not affected because ESXi uses the Ash shell (through    busybox), which is not affected by the vulnerability reported    for the Bash shell.
   ESX has an affected version of the Bash shell. See table 1 for    remediation for ESX.
    II) Windows-based products    Windows-based products, including all versions of vCenter Server    running on Windows, are not affected.

   III) VMware (virtual) appliances    VMware (virtual) appliances ship with an affected version of Bash.    See table 2 for remediation for appliances.
      IV) Products that run on Linux, Android, OSX or iOS (excluding    virtual appliances)

   Products that run on Linux, Android, OSX or iOS (excluding    virtual appliances) might use the Bash shell that is part of the    operating system. If the operating system has a vulnerable    version of Bash, the Bash security vulnerability might be    exploited through the product. VMware recommends that customers    contact their operating system vendor for a patch.          MITIGATIONS

   VMware encourages restricting access to appliances through    firewall rules and other network layer controls to only trusted IP    addresses. This measure will greatly reduce any risk to these    appliances.

   RECOMMENDATIONS

   VMware recommends customers evaluate and deploy patches for    affected products in Table 1 and 2 below as these    patches become available. 

   For several products, both a patch and a product update are available.
   In general, if a patch is  made available, the patch must be applied    to the latest version of the appliance.

   Customers should refer to the specific product Knowledge Base articles    listed in Section 4 to understand the type of remediation available and    applicable appliance version numbers.

   Column 4 of the following tables lists the action required to    remediate the vulnerability in each release, if a solution is    available.

   Table 1 - ESXi and ESX Hypervisor    =================================

SunOS 5.9_x86: bash patch.
Date this patch was last updated by Sun : Sep/30/14

The remote Solaris system is missing necessary patches to address security updates :

  - GNU Bash through 4.3 processes trailing strings after     function definitions in the values of environment     variables, which allows remote attackers to execute     arbitrary code via a crafted environment, as     demonstrated by vectors involving the ForceCommand     feature in OpenSSH sshd, the mod_cgi and mod_cgid     modules in the Apache HTTP Server, scripts executed by     unspecified DHCP clients, and other situations in which     setting the environment occurs across a privilege     boundary from Bash execution, aka 'ShellShock.' NOTE:
    the original fix for this issue was incorrect;
    CVE-2014-7169 has been assigned to cover the     vulnerability that is still present after the incorrect     fix. (CVE-2014-6271)

  - GNU Bash through 4.3 bash43-026 does not properly parse     function definitions in the values of environment     variables, which allows remote attackers to execute     arbitrary commands via a crafted environment, as     demonstrated by vectors involving the ForceCommand     feature in OpenSSH sshd, the mod_cgi and mod_cgid     modules in the Apache HTTP Server, scripts executed by     unspecified DHCP clients, and other situations in which     setting the environment occurs across a privilege     boundary from Bash execution. NOTE: this vulnerability     exists because of an incomplete fix for CVE-2014-6271,     CVE-2014-7169, and CVE-2014-6277. (CVE-2014-6278)

  - GNU Bash through 4.3 bash43-025 processes trailing     strings after certain malformed function definitions in     the values of environment variables, which allows remote     attackers to write to files or possibly have unknown     other impact via a crafted environment, as demonstrated     by vectors involving the ForceCommand feature in OpenSSH     sshd, the mod_cgi and mod_cgid modules in the Apache     HTTP Server, scripts executed by unspecified DHCP     clients, and other situations in which setting the     environment occurs across a privilege boundary from Bash     execution. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2014-6271. (CVE-2014-7169)

  - The redirection implementation in parse.y in GNU Bash     through 4.3 bash43-026 allows remote attackers to cause     a denial of service (out-of-bounds array access and     application crash) or possibly have unspecified other     impact via crafted use of here documents, aka the     'redir_stack' issue. (CVE-2014-7186)

  - Off-by-one error in the read_token_word function in     parse.y in GNU Bash through 4.3 bash43-026 allows remote     attackers to cause a denial of service (out-of-bounds     array access and application crash) or possibly have     unspecified other impact via deeply nested for loops,     aka the 'word_lineno' issue. (CVE-2014-7187)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
82417	Mandriva Linux Security Advisory : bash (MDVSA-2015:164)	Nessus	Mandriva Local Security Checks	2015/3/30	2025/10/3	critical
87680	VMware ESX Multiple Bash Vulnerabilities (VMSA-2014-0010) (Shellshock)	Nessus	Misc.	2015/12/30	2025/10/3	critical
78587	Palo Alto Networks PAN-OS < 5.0.15 / 5.1.x < 5.1.10 / 6.0.x < 6.0.6 / 6.1.x < 6.1.1 Bash Shell Remote Code Execution (Shellshock)	Nessus	Palo Alto Local Security Checks	2014/10/20	2022/12/5	critical
78828	Cisco Prime Security Manager GNU Bash Environment Variable Handling Command Injection (cisco-sa-20140926-bash) (Shellshock)	Nessus	CGI abuses	2014/11/3	2025/10/3	critical
79147	VMware vCenter Converter 5.1.x < 5.1.2 / 5.5.x < 5.5.3 Multiple Vulnerabilities (VMSA-2014-0010) (Shellshock)	Nessus	Windows	2014/11/12	2025/10/3	critical
77857	GNU Bash Local Environment Variable Handling Command Injection via Telnet (CVE-2014-7169) (Shellshock)	Nessus	Gain a shell remotely	2014/9/25	2023/4/25	critical
77892	Oracle Linux 7 : bash (ELSA-2014-3076)	Nessus	Oracle Linux Local Security Checks	2014/9/26	2024/10/22	critical
77894	Oracle Linux 4 : bash (ELSA-2014-3078)	Nessus	Oracle Linux Local Security Checks	2014/9/26	2023/4/25	critical
77941	Fedora 20 : bash-4.2.48-2.fc20 (2014-11527) (Shellshock)	Nessus	Fedora Local Security Checks	2014/9/29	2022/12/5	critical
77951	Oracle Linux 5 / 6 / 7 : bash (ELSA-2014-1306)	Nessus	Oracle Linux Local Security Checks	2014/9/29	2024/10/23	critical
77969	Postfix Script Remote Command Execution via Shellshock	Nessus	SMTP problems	2014/9/29	2022/12/5	critical
77971	GNU Bash Local Environment Variable Handling Command Injection (Mac OS X) (Shellshock)	Nessus	MacOS X Local Security Checks	2014/9/30	2023/11/27	critical
78025	VMSA-2014-0010 : VMware product updates address critical Bash security vulnerabilities (Shellshock)	Nessus	VMware ESX Local Security Checks	2014/10/2	2025/10/3	critical
78113	Solaris 9 (x86) : 149080-02	Nessus	Solaris Local Security Checks	2014/10/9	2022/12/5	critical
80590	Oracle Solaris Third-Party Patch Update : bash (multiple_vulnerabilities_in_bash) (Shellshock)	Nessus	Solaris Local Security Checks	2015/1/19	2025/10/3	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical