ID

VAR-201409-0366


CVE

CVE-2014-6277


TITLE

GNU Bash shell executes commands in exported functions in environment variables

Trust: 0.8

sources: CERT/CC: VU#252743

DESCRIPTION

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169. This vulnerability CVE-2014-6271 and CVE-2014-7169 Vulnerability due to insufficient fix for.Arbitrary code execution or denial of service by a third party through a crafted environment ( Uninitialized memory access and untrusted pointer read and write operations ) There is a possibility of being put into a state. GNU Bash 4.3 and earlier contains a command injection vulnerability that may allow remote code execution. An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. NOTE: This vulnerability can only be exploited if the attacker already has valid administrative login credentials. This vulnerability allows users that have been granted access to a shell script to escalate privilege and execute unrestricted commands at the same security level as the Bash script. Customers who need to upgrade the firmware of their Superdome X or HP Converged System 900 for SAP HANA should contact HP Technical Support to obtain the firmware or plan to schedule an onsite visit with an HP Services field service professional. NOTE: HP strongly recommends implementing the following security best practices to help reduce both known and future security vulnerability risks: Isolate the HP Superdome X or HP Converged System 900 for SAP HANA's management network by keeping it separate from the data or production network, and not connecting it directly to the Internet without additional access authentication. Patch and maintain Lightweight Directory Access Protocol (LDAP) and web servers. Use virus scanners, intrusion detection/prevention systems (IDS/IPS), and vulnerability scanners regularly. ============================================================================ Ubuntu Security Notice USN-2380-1 October 09, 2014 bash vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: Several security issues were fixed in Bash. If an attacker were able to create an environment variable containing a function definition with a very specific name, these issues could possibly be used to bypass certain environment restrictions and execute arbitrary code. (CVE-2014-6277, CVE-2014-6278) Please note that the previous Bash security update, USN-2364-1, includes a hardening measure that prevents these issues from being used in a Shellshock attack. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: bash 4.3-7ubuntu1.5 Ubuntu 12.04 LTS: bash 4.2-2ubuntu2.6 Ubuntu 10.04 LTS: bash 4.1-2ubuntu3.5 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2380-1 CVE-2014-6277, CVE-2014-6278 Package Information: https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.5 https://launchpad.net/ubuntu/+source/bash/4.2-2ubuntu2.6 https://launchpad.net/ubuntu/+source/bash/4.1-2ubuntu3.5 . -----BEGIN PGP SIGNED MESSAGE----- CA20141001-01: Security Notice for Bash Shellshock Vulnerability Issued: October 01, 2014 Updated: October 03, 2014 CA Technologies is investigating multiple GNU Bash vulnerabilities, referred to as the "Shellshock" vulnerabilities, which were publicly disclosed on September 24-27, 2014. CVE identifiers CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, and CVE-2014-6278 have been assigned to these vulnerabilities. The CA Technologies Enterprise Information Security team has led a global effort to identify and remediate systems and products discovered with these vulnerabilities. We continue to patch our systems as fixes become available, and we are providing fixes for affected CA Technologies products. CA Technologies continues to aggressively scan our environments (including servers, networks, external facing applications, and SaaS environments) to proactively monitor, identify, and remediate any vulnerability when necessary. Risk Rating High Platform AIX Android (not vulnerable, unless rooted) Apple iOS (not vulnerable unless jailbroken) Linux Mac OS X Solaris Windows (not vulnerable unless Cygwin or similar ported Linux tools with Bash shell are installed) Other UNIX/BSD based systems if Bash is installed Any other OS or JeOS that utilizes Bash Affected Products The following products have been identified as potentially vulnerable, and we have made fixes available for all of these products. CA API Management (Linux appliance only) CA Application Performance Management (TIM is the only affected APM component) CA Application Performance Management Cloud Monitor CA Customer Experience Manager (CEM) Transaction Impact Monitor (TIM) CA Layer 7 products (API Gateway, Mobile Access Gateway, API Management Portal) CA User Activity Reporting Module (Enterprise Log Manager) Note: This security notice will be updated if other CA Technologies products are determined to be vulnerable. In most cases, the Bash vulnerabilities will need to be patched by OS vendors. Exceptions may include CA Technologies appliances, and software products that include Linux, UNIX or Mac OS X based operating systems (that include Bash). Affected Components CentOS Cygwin GNU Bash Red Hat Enterprise Linux SUSE Linux Non-Affected Products IMPORTANT NOTE: This listing includes only a small subset of the unaffected CA Technologies products. We're including unaffected products that customers have already inquired about. While the following CA Technologies products are not directly affected by the Bash vulnerabilities, the underlying operating systems that CA Technologies software is installed on may be vulnerable. We strongly encourage our customers to follow the recommendations provided by their vendors for all operating systems they utilize. All CA SaaS / On Demand products were either not vulnerable or have already been patched. CA AHS / PaymentMinder - AHS App is not vulnerable. The AHS app does not execute CGI scripts, or spawn or execute shell commands from within the app. AHS infrastructure already patched. CA Asset Portfolio Management CA AuthMinder (Arcot WebFort) CA AuthMinder for Business Users CA AuthMinder for Consumers CA AutoSys products - We use the bash shell that comes with the operating system and the customer is responsible for patching their OS. Additionally, the agents themselves do not distribute any scripts that use bash. CA Clarity On Demand CA CloudMinder - CloudMinder does not include the Bash Shell in BoM, or use it, but because we are deployed on RHEL, customers may be indirectly affected. Customers using RHEL should apply patches provided by Red Hat. CA Console Management for OpenVMS - Our OpenVMS products do not bundle bash, and they do not supply bash scripts; we use nothing but the native DCL CLI. CA ControlMinder CA DataMinder (formerly DLP) products – Software and appliance confirmed not vulnerable. Note: Linux Agents shipped, but no public SSH or Web apps are used in these agents. Customers should patch bash shell on any Linux server with DataMinder agents. DataMinder agents should continue to function normally. CA Digital Payments SaaS (previously patched) CA Directory CA eCommerce SaaS / On Demand (previously patched) CA Endevor Software Change Manager CA Federation (formerly SiteMinder Federation) CA GovernanceMinder CA IdentityMinder CA Infrastructure Management CA JCLCheck CA Job Management for OpenVMS - Our OpenVMS products do not bundle bash, and they do not supply bash scripts; we use nothing but the native DCL CLI. CA NetQoS GigaStor Observer Expert CA Network Flow Analysis CA Performance Management for OpenVMS - Our OpenVMS products do not bundle bash, and they do not supply bash scripts; we use nothing but the native DCL CLI. CA RiskMinder CA Service Desk Manager CA Service Operations Insight (SOI) CA SiteMinder CA SOLVE:Access CA Spectrum for Linux - Not vulnerable. Be sure to apply bash fixes from your underlying operating system vendor. CA Strong Authentication CA System Watchdog for OpenVMS - Our OpenVMS products do not bundle bash, and they do not supply bash scripts; we use nothing but the native DCL CLI. CA Top Secret CA Universal Job Management Agent for OpenVMS - Our OpenVMS products do not bundle bash, and they do not supply bash scripts; we use nothing but the native DCL CLI. CA Virtual Assurance for Infrastructure Managers (VAIM) Solution CA Technologies has issued the following fixes to address the vulnerabilities. CA API Management: Patches for Linux appliance are available through CA Support to customers of Gateway (applicable for all versions – 6.1.5, 6.2, 7.0, 7.1, 8.0, 8.1, 8.1.1, 8.1.02). CA Application Performance Management: KB article for APM TIM has been published. APM TIM is the only part of APM that was affected. Refer to TEC618037. CA Application Performance Management Cloud Monitor: New images are available for subscribers. Download the latest OPMS version 8.2.1.5. For assistance, contact CA Support. CA Customer Experience Manager (CEM) Transaction Impact Monitor (TIM): Very low risk. 9.6 is not affected. 9.5 Installation uses Bash. We do not use Bash at all for the CEM operating system that we have shipped in the past. This means that customers who patch the OS will not impact the ability of the CEM TIMsoft from operating. However prior to version 9.6, the TIM installation script does use the bash shell. See new KB article TEC618037 for additional information. CA Layer 7 (API Gateway, Mobile Access Gateway, API Management Portal): Fixes for all Bash vulnerabilities and a security bulletin are available on the Layer 7 Support website. CA User Activity Reporting Module (Enterprise Log Manager): All 12.5 and 12.6 GA versions are potentially affected. Patches provided on 2014-09-30. To get the patch, use the OS update functionality to get the latest R12.6 SP1 subscription update. Note that you can update R12.5 SPx with the R12.6 SP1 OS update. For assistance, contact CA Support. Workaround None To help mitigate the risk, we do strongly encourage all customers to follow patch management best practices, and in particular for operating systems affected by the Bash Shellshock vulnerabilities. References CVE-2014-6271 - Bash environment variable command injection CVE-2014-7169 - Bash environment variable incomplete fix for CVE-2014-6271 CVE-2014-7186 - Bash parser redir_stack memory corruption CVE-2014-7187 - Bash nested flow control constructs off-by-one CVE-2014-6277 - Bash untrusted pointer use uninitialized memory CVE-2014-6278 - Bash environment variable command injection CA20141001-01: Security Notice for Bash Shellshock Vulnerability https://support.ca.com/irj/portal/anonymous/phpsbpldgpg Change History v1.0: 2014-10-01, Initial Release v1.1: 2014-10-02, Added AuthMinder, Strong Authentication, VAIM, Clarity OD, All SaaS/OD products to list of Non-Affected Products. v1.2: 2014-10-03, Added RiskMinder to Non-Affected Products. Updated UARM solution info. If additional information is required, please contact CA Technologies Support at https://support.ca.com. If you discover a vulnerability in CA Technologies products, please report your findings to the CA Technologies Product Vulnerability Response Team at vuln@ca.com. PGP key: support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=177782 Security Notices https://support.ca.com/irj/portal/anonymous/phpsbpldgpg Regards, Ken Williams Director, Product Vulnerability Response Team CA Technologies | One CA Plaza | Islandia, NY 11749 | www.ca.com Ken.Williams@ca.com | vuln@ca.com Copyright © 2014 CA. All Rights Reserved. One CA Plaza, Islandia, N.Y. 11749. All other trademarks, trade names, service marks, and logos referenced herein belong to their respective companies. -----BEGIN PGP SIGNATURE----- Version: Encryption Desktop 10.3.2 (Build 15238) Charset: utf-8 wsBVAwUBVDK+PZI1FvIeMomJAQFl/Af/TqrSE/h4r3gs9PwrWKdt21PCRI3za9Lx M5ZyTdVDIQ9ybgPkLqsovNRPgVqd7zwDHsx0rzvF5Y82uO+vQ63BuEV2GnczAax/ EiAW4WVxUgWG+lAowGV55Of8ruv/gOiAWTjFhkqpsyVg96ZMw2HLG62IwZL1j0qa oLCu0y3VrGvqH0g2hi75QwHAjNCdlEsD4onUqTCc9cRTdLwFCZrUQ8KTrqIL7LK5 Uo5T9C1UeAyNTo3KiJ/zw3BCOTkpl99dmg3NW0onU/1r1CXdlyS7opLB+GJ+xGwP xRQdUsOIhzfRzx7bsao2D43IhDnzJBBFJHdeMPo18WBTfJ7aUgBwGQ== =B62b -----END PGP SIGNATURE----- . HP Product Firmware Version HP StoreEver ESL G3 Tape Libraries with MCB version 2 680H_GS40701 HP StoreEver ESL G3 Tape Libraries with MCB version 1 656H_GS10801 The firmware is customer installable and is available in the Drivers, Software & Firmware section at the following location: http://www.hp.com/support/eslg3 Notes: - Updating the library firmware requires a reboot of the library. - Disable DHCP and only use static IP addressing. This bulletin will be revised when the updates are available. MITIGATION INFORMATION HP recommends the following steps to reduce the risk of this vulnerability: - The "ssh" or "telnet" features may be disabled by the admin user. All MDS and Nexus 5K switches can function in this configuration. Access is available through the console port. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2015-09-30-3 OS X El Capitan 10.11 OS X El Capitan 10.11 is now available and addresses the following: Address Book Available for: Mac OS X v10.6.8 and later Impact: A local attacker may be able to inject arbitrary code to processes loading the Address Book framework Description: An issue existed in Address Book framework's handling of an environment variable. This issue was addressed through improved environment variable handling. CVE-ID CVE-2015-5897 : Dan Bastone of Gotham Digital Science AirScan Available for: Mac OS X v10.6.8 and later Impact: An attacker with a privileged network position may be able to extract payload from eSCL packets sent over a secure connection Description: An issue existed in the processing of eSCL packets. This issue was addressed through improved validation checks. CVE-ID CVE-2015-5853 : an anonymous researcher apache_mod_php Available for: Mac OS X v10.6.8 and later Impact: Multiple vulnerabilities in PHP Description: Multiple vulnerabilities existed in PHP versions prior to 5.5.27, including one which may have led to remote code execution. This issue was addressed by updating PHP to version 5.5.27. CVE-ID CVE-2014-9425 CVE-2014-9427 CVE-2014-9652 CVE-2014-9705 CVE-2014-9709 CVE-2015-0231 CVE-2015-0232 CVE-2015-0235 CVE-2015-0273 CVE-2015-1351 CVE-2015-1352 CVE-2015-2301 CVE-2015-2305 CVE-2015-2331 CVE-2015-2348 CVE-2015-2783 CVE-2015-2787 CVE-2015-3329 CVE-2015-3330 Apple Online Store Kit Available for: Mac OS X v10.6.8 and later Impact: A malicious application may gain access to a user's keychain items Description: An issue existed in validation of access control lists for iCloud keychain items. This issue was addressed through improved access control list checks. CVE-ID CVE-2015-5836 : XiaoFeng Wang of Indiana University, Luyi Xing of Indiana University, Tongxin Li of Peking University, Tongxin Li of Peking University, Xiaolong Bai of Tsinghua University AppleEvents Available for: Mac OS X v10.6.8 and later Impact: A user connected through screen sharing can send Apple Events to a local user's session Description: An issue existed with Apple Event filtering that allowed some users to send events to other users. This was addressed by improved Apple Event handling. CVE-ID CVE-2015-5849 : Jack Lawrence (@_jackhl) Audio Available for: Mac OS X v10.6.8 and later Impact: Playing a malicious audio file may lead to an unexpected application termination Description: A memory corruption issue existed in the handling of audio files. This issue issue was addressed through improved memory handling. CVE-ID CVE-2015-5862 : YoungJin Yoon of Information Security Lab. (Adv.: Prof. Taekyoung Kwon), Yonsei University, Seoul, Korea bash Available for: Mac OS X v10.6.8 and later Impact: Multiple vulnerabilities in bash Description: Multiple vulnerabilities existed in bash versions prior to 3.2 patch level 57. These issues were addressed by updating bash version 3.2 to patch level 57. CVE-ID CVE-2014-6277 CVE-2014-7186 CVE-2014-7187 Certificate Trust Policy Available for: Mac OS X v10.6.8 and later Impact: Update to the certificate trust policy Description: The certificate trust policy was updated. The complete list of certificates may be viewed at https://support.apple.com/en- us/HT202858. CFNetwork Cookies Available for: Mac OS X v10.6.8 and later Impact: An attacker in a privileged network position can track a user's activity Description: A cross-domain cookie issue existed in the handling of top level domains. The issue was address through improved restrictions of cookie creation. CVE-ID CVE-2015-5885 : Xiaofeng Zheng of Blue Lotus Team, Tsinghua University CFNetwork FTPProtocol Available for: Mac OS X v10.6.8 and later Impact: Malicious FTP servers may be able to cause the client to perform reconnaissance on other hosts Description: An issue existed in the handling of FTP packets when using the PASV command. This issue was resolved through improved validation. CVE-ID CVE-2015-5912 : Amit Klein CFNetwork HTTPProtocol Available for: Mac OS X v10.6.8 and later Impact: A maliciously crafted URL may be able to bypass HSTS and leak sensitive data Description: A URL parsing vulnerability existed in HSTS handling. This issue was addressed through improved URL parsing. CVE-ID CVE-2015-5858 : Xiaofeng Zheng of Blue Lotus Team, Tsinghua University CFNetwork HTTPProtocol Available for: Mac OS X v10.6.8 and later Impact: A malicious website may be able to track users in Safari private browsing mode Description: An issue existed in the handling of HSTS state in Safari private browsing mode. This issue was addressed through improved state handling. CVE-ID CVE-2015-5860 : Sam Greenhalgh of RadicalResearch Ltd CFNetwork Proxies Available for: Mac OS X v10.6.8 and later Impact: Connecting to a malicious web proxy may set malicious cookies for a website Description: An issue existed in the handling of proxy connect responses. This issue was addressed by removing the set-cookie header while parsing the connect response. CVE-ID CVE-2015-5841 : Xiaofeng Zheng of Blue Lotus Team, Tsinghua University CFNetwork SSL Available for: Mac OS X v10.6.8 and later Impact: An attacker with a privileged network position may intercept SSL/TLS connections Description: A certificate validation issue existed in NSURL when a certificate changed. This issue was addressed through improved certificate validation. CVE-ID CVE-2015-5824 : Timothy J. Wood of The Omni Group CFNetwork SSL Available for: Mac OS X v10.6.8 and later Impact: An attacker may be able to decrypt data protected by SSL Description: There are known attacks on the confidentiality of RC4. An attacker could force the use of RC4, even if the server preferred better ciphers, by blocking TLS 1.0 and higher connections until CFNetwork tried SSL 3.0, which only allows RC4. This issue was addressed by removing the fallback to SSL 3.0. CoreCrypto Available for: Mac OS X v10.6.8 and later Impact: An attacker may be able to determine a private key Description: By observing many signing or decryption attempts, an attacker may have been able to determine the RSA private key. This issue was addressed using improved encryption algorithms. CoreText Available for: Mac OS X v10.6.8 and later Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory corruption issue existed in the processing of font files. This issue was addressed through improved input validation. CVE-ID CVE-2015-5874 : John Villamil (@day6reak), Yahoo Pentest Team Dev Tools Available for: Mac OS X v10.6.8 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: A memory corruption issue existed in dyld. This was addressed through improved memory handling. CVE-ID CVE-2015-5876 : beist of grayhash Dev Tools Available for: Mac OS X v10.6.8 and later Impact: An application may be able to bypass code signing Description: An issue existed with validation of the code signature of executables. This issue was addressed through improved bounds checking. CVE-ID CVE-2015-5839 : @PanguTeam Disk Images Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to execute arbitrary code with system privileges Description: A memory corruption issue existed in DiskImages. This issue was addressed through improved memory handling. CVE-ID CVE-2015-5847 : Filippo Bigarella, Luca Todesco dyld Available for: Mac OS X v10.6.8 and later Impact: An application may be able to bypass code signing Description: An issue existed with validation of the code signature of executables. This issue was addressed through improved bounds checking. CVE-ID CVE-2015-5839 : TaiG Jailbreak Team EFI Available for: Mac OS X v10.6.8 and later Impact: A malicious application can prevent some systems from booting Description: An issue existed with the addresses covered by the protected range register. This issue was fixed by changing the protected range. CVE-ID CVE-2015-5900 : Xeno Kovah & Corey Kallenberg from LegbaCore EFI Available for: Mac OS X v10.6.8 and later Impact: A malicious Apple Ethernet Thunderbolt adapter may be able to affect firmware flashing Description: Apple Ethernet Thunderbolt adapters could modify the host firmware if connected during an EFI update. This issue was addressed by not loading option ROMs during updates. CVE-ID CVE-2015-5914 : Trammell Hudson of Two Sigma Investments and snare Finder Available for: Mac OS X v10.6.8 and later Impact: The "Secure Empty Trash" feature may not securely delete files placed in the Trash Description: An issue existed in guaranteeing secure deletion of Trash files on some systems, such as those with flash storage. This issue was addressed by removing the "Secure Empty Trash" option. CVE-ID CVE-2015-5901 : Apple Game Center Available for: Mac OS X v10.6.8 and later Impact: A malicious Game Center application may be able to access a player's email address Description: An issue existed in Game Center in the handling of a player's email. This issue was addressed through improved access restrictions. CVE-ID CVE-2015-5855 : Nasser Alnasser Heimdal Available for: Mac OS X v10.6.8 and later Impact: An attacker may be able to replay Kerberos credentials to the SMB server Description: An authentication issue existed in Kerberos credentials. This issue was addressed through additional validation of credentials using a list of recently seen credentials. CVE-ID CVE-2015-5913 : Tarun Chopra of Microsoft Corporation, U.S. and Yu Fan of Microsoft Corporation, China ICU Available for: Mac OS X v10.6.8 and later Impact: Multiple vulnerabilities in ICU Description: Multiple vulnerabilities existed in ICU versions prior to 53.1.0. These issues were addressed by updating ICU to version 55.1. CVE-ID CVE-2014-8146 CVE-2014-8147 CVE-2015-5922 Install Framework Legacy Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to gain root privileges Description: A restriction issue existed in the Install private framework containing a privileged executable. This issue was addressed by removing the executable. CVE-ID CVE-2015-5888 : Apple Intel Graphics Driver Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to execute arbitrary code with system privileges Description: Multiple memory corruption issues existed in the Intel Graphics Driver. These issues were addressed through improved memory handling. CVE-ID CVE-2015-5830 : Yuki MIZUNO (@mzyy94) CVE-2015-5877 : Camillus Gerard Cai IOAudioFamily Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to determine kernel memory layout Description: An issue existed in IOAudioFamily that led to the disclosure of kernel memory content. This issue was addressed by permuting kernel pointers. CVE-ID CVE-2015-5864 : Luca Todesco IOGraphics Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues existed in the kernel. These issues were addressed through improved memory handling. CVE-ID CVE-2015-5871 : Ilja van Sprundel of IOActive CVE-2015-5872 : Ilja van Sprundel of IOActive CVE-2015-5873 : Ilja van Sprundel of IOActive CVE-2015-5890 : Ilja van Sprundel of IOActive IOGraphics Available for: Mac OS X v10.6.8 and later Impact: A malicious application may be able to determine kernel memory layout Description: An issue existed in IOGraphics which could have led to the disclosure of kernel memory layout. This issue was addressed through improved memory management. CVE-ID CVE-2015-5865 : Luca Todesco IOHIDFamily Available for: Mac OS X v10.6.8 and later Impact: A malicious application may be able to execute arbitrary code with system privileges Description: Multiple memory corruption issues existed in IOHIDFamily. These issues were addressed through improved memory handling. CVE-ID CVE-2015-5866 : Apple CVE-2015-5867 : moony li of Trend Micro IOStorageFamily Available for: Mac OS X v10.6.8 and later Impact: A local attacker may be able to read kernel memory Description: A memory initialization issue existed in the kernel. This issue was addressed through improved memory handling. CVE-ID CVE-2015-5863 : Ilja van Sprundel of IOActive Kernel Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to execute arbitrary code with kernel privileges Description: Multiple memory corruption issues existed in the Kernel. These issues were addressed through improved memory handling. CVE-ID CVE-2015-5868 : Cererdlong of Alibaba Mobile Security Team CVE-2015-5896 : Maxime Villard of m00nbsd CVE-2015-5903 : CESG Kernel Available for: Mac OS X v10.6.8 and later Impact: A local process can modify other processes without entitlement checks Description: An issue existed where root processes using the processor_set_tasks API were allowed to retrieve the task ports of other processes. This issue was addressed through additional entitlement checks. CVE-ID CVE-2015-5882 : Pedro Vilaca, working from original research by Ming-chieh Pan and Sung-ting Tsai; Jonathan Levin Kernel Available for: Mac OS X v10.6.8 and later Impact: A local attacker may control the value of stack cookies Description: Multiple weaknesses existed in the generation of user space stack cookies. These issues were addressed through improved generation of stack cookies. CVE-ID CVE-2013-3951 : Stefan Esser Kernel Available for: Mac OS X v10.6.8 and later Impact: An attacker may be able to launch denial of service attacks on targeted TCP connections without knowing the correct sequence number Description: An issue existed in xnu's validation of TCP packet headers. This issue was addressed through improved TCP packet header validation. CVE-ID CVE-2015-5879 : Jonathan Looney Kernel Available for: Mac OS X v10.6.8 and later Impact: An attacker in a local LAN segment may disable IPv6 routing Description: An insufficient validation issue existed in the handling of IPv6 router advertisements that allowed an attacker to set the hop limit to an arbitrary value. This issue was addressed by enforcing a minimum hop limit. CVE-ID CVE-2015-5869 : Dennis Spindel Ljungmark Kernel Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to determine kernel memory layout Description: An issue existed that led to the disclosure of kernel memory layout. This was addressed through improved initialization of kernel memory structures. CVE-ID CVE-2015-5842 : beist of grayhash Kernel Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to determine kernel memory layout Description: An issue existed in debugging interfaces that led to the disclosure of memory content. This issue was addressed by sanitizing output from debugging interfaces. CVE-ID CVE-2015-5870 : Apple Kernel Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to cause a system denial of service Description: A state management issue existed in debugging functionality. This issue was addressed through improved validation. CVE-ID CVE-2015-5902 : Sergi Alvarez (pancake) of NowSecure Research Team libc Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue existed in the kernel. This issue was addressed through improved memory handling. CVE-ID CVE-2014-8611 : Adrian Chadd and Alfred Perlstein of Norse Corporation libpthread Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue existed in the kernel. This issue was addressed through improved memory handling. CVE-ID CVE-2015-5899 : Lufeng Li of Qihoo 360 Vulcan Team libxpc Available for: Mac OS X v10.6.8 and later Impact: Many SSH connections could cause a denial of service Description: launchd had no limit on the number of processes that could be started by a network connection. This issue was addressed by limiting the number of SSH processes to 40. CVE-ID CVE-2015-5881 : Apple Login Window Available for: Mac OS X v10.6.8 and later Impact: The screen lock may not engage after the specified time period Description: An issue existed with captured display locking. The issue was addressed through improved lock handling. CVE-ID CVE-2015-5833 : Carlos Moreira, Rainer Dorau of rainer dorau informationsdesign, Chris Nehren, Kai Takac, Hans Douma, Toni Vaahtera, and an anonymous researcher lukemftpd Available for: Mac OS X v10.6.8 and later Impact: A remote attacker may be able to deny service to the FTP server Description: A glob-processing issue existed in tnftpd. This issue was addressed through improved glob validation. CVE-ID CVE-2015-5917 : Maksymilian Arciemowicz of cxsecurity.com Mail Available for: Mac OS X v10.6.8 and later Impact: Printing an email may leak sensitive user information Description: An issue existed in Mail which bypassed user preferences when printing an email. This issue was addressed through improved user preference enforcement. CVE-ID CVE-2015-5881 : Owen DeLong of Akamai Technologies, Noritaka Kamiya, Dennis Klein from Eschenburg, Germany, Jeff Hammett of Systim Technology Partners Mail Available for: Mac OS X v10.6.8 and later Impact: An attacker in a privileged network position may be able to intercept attachments of S/MIME-encrypted e-mail sent via Mail Drop Description: An issue existed in handling encryption parameters for large email attachments sent via Mail Drop. The issue is addressed by no longer offering Mail Drop when sending an encrypted e-mail. CVE-ID CVE-2015-5884 : John McCombs of Integrated Mapping Ltd Multipeer Connectivity Available for: Mac OS X v10.6.8 and later Impact: A local attacker may be able to observe unprotected multipeer data Description: An issue existed in convenience initializer handling in which encryption could be actively downgraded to a non-encrypted session. This issue was addressed by changing the convenience initializer to require encryption. CVE-ID CVE-2015-5851 : Alban Diquet (@nabla_c0d3) of Data Theorem NetworkExtension Available for: Mac OS X v10.6.8 and later Impact: A malicious application may be able to determine kernel memory layout Description: An uninitialized memory issue in the kernel led to the disclosure of kernel memory content. This issue was addressed through improved memory initialization. CVE-ID CVE-2015-5831 : Maxime Villard of m00nbsd Notes Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to leak sensitive user information Description: An issue existed in parsing links in the Notes application. This issue was addressed through improved input validation. CVE-ID CVE-2015-5878 : Craig Young of Tripwire VERT, an anonymous researcher Notes Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to leak sensitive user information Description: A cross-site scripting issue existed in parsing text by the Notes application. This issue was addressed through improved input validation. CVE-ID CVE-2015-5875 : xisigr of Tencent's Xuanwu LAB (www.tencent.com) OpenSSH Available for: Mac OS X v10.6.8 and later Impact: Multiple vulnerabilities in OpenSSH Description: Multiple vulnerabilities existed in OpenSSH versions prior to 6.9. These issues were addressed by updating OpenSSH to version 6.9. CVE-ID CVE-2014-2532 OpenSSL Available for: Mac OS X v10.6.8 and later Impact: Multiple vulnerabilities in OpenSSL Description: Multiple vulnerabilities existed in OpenSSL versions prior to 0.9.8zg. These were addressed by updating OpenSSL to version 0.9.8zg. CVE-ID CVE-2015-0286 CVE-2015-0287 procmail Available for: Mac OS X v10.6.8 and later Impact: Multiple vulnerabilities in procmail Description: Multiple vulnerabilities existed in procmail versions prior to 3.22. These issues were addressed by removing procmail. CVE-ID CVE-2014-3618 remote_cmds Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to execute arbitrary code with root privileges Description: An issue existed in the usage of environment variables by the rsh binary. This issue was addressed by dropping setuid privileges from the rsh binary. CVE-ID CVE-2015-5889 : Philip Pettersson removefile Available for: Mac OS X v10.6.8 and later Impact: Processing malicious data may lead to unexpected application termination Description: An overflow fault existed in the checkint division routines. This issue was addressed with improved division routines. CVE-ID CVE-2015-5840 : an anonymous researcher Ruby Available for: Mac OS X v10.6.8 and later Impact: Multiple vulnerabilities in Ruby Description: Multiple vulnerabilities existed in Ruby versions prior to 2.0.0p645. These were addressed by updating Ruby to version 2.0.0p645. CVE-ID CVE-2014-8080 CVE-2014-8090 CVE-2015-1855 Security Available for: Mac OS X v10.6.8 and later Impact: The lock state of the keychain may be incorrectly displayed to the user Description: A state management issue existed in the way keychain lock status was tracked. This issue was addressed through improved state management. CVE-ID CVE-2015-5915 : Peter Walz of University of Minnesota, David Ephron, Eric E. Lawrence, Apple Security Available for: Mac OS X v10.6.8 and later Impact: A trust evaluation configured to require revocation checking may succeed even if revocation checking fails Description: The kSecRevocationRequirePositiveResponse flag was specified but not implemented. This issue was addressed by implementing the flag. CVE-ID CVE-2015-5894 : Hannes Oud of kWallet GmbH Security Available for: Mac OS X v10.6.8 and later Impact: A remote server may prompt for a certificate before identifying itself Description: Secure Transport accepted the CertificateRequest message before the ServerKeyExchange message. This issue was addressed by requiring the ServerKeyExchange first. CVE-ID CVE-2015-5887 : Benjamin Beurdouche, Karthikeyan Bhargavan, Antoine Delignat-Lavaud, Alfredo Pironti, and Jean Karim Zinzindohoue of INRIA Paris-Rocquencourt, and Cedric Fournet and Markulf Kohlweiss of Microsoft Research, Pierre-Yves Strub of IMDEA Software Institute SMB Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue existed in the kernel. This issue was addressed through improved memory handling. CVE-ID CVE-2015-5891 : Ilja van Sprundel of IOActive SMB Available for: Mac OS X v10.6.8 and later Impact: A local user may be able to determine kernel memory layout Description: An issue existed in SMBClient that led to the disclosure of kernel memory content. This issue was addressed through improved bounds checking. CVE-ID CVE-2015-5893 : Ilja van Sprundel of IOActive SQLite Available for: Mac OS X v10.6.8 and later Impact: Multiple vulnerabilities in SQLite v3.8.5 Description: Multiple vulnerabilities existed in SQLite v3.8.5. These issues were addressed by updating SQLite to version 3.8.10.2. CVE-ID CVE-2015-3414 CVE-2015-3415 CVE-2015-3416 Telephony Available for: Mac OS X v10.6.8 and later Impact: A local attacker can place phone calls without the user's knowledge when using Continuity Description: An issue existed in the authorization checks for placing phone calls. This issue was addressed through improved authorization checks. CVE-ID CVE-2015-3785 : Dan Bastone of Gotham Digital Science Terminal Available for: Mac OS X v10.6.8 and later Impact: Maliciously crafted text could mislead the user in Terminal Description: Terminal did not handle bidirectional override characters in the same way when displaying text and when selecting text. This issue was addressed by suppressing bidirectional override characters in Terminal. CVE-ID CVE-2015-5883 : an anonymous researcher tidy Available for: Mac OS X v10.6.8 and later Impact: Visiting a maliciously crafted website may lead to arbitrary code execution Description: Multiple memory corruption issues existed in tidy. These issues were addressed through improved memory handling. CVE-ID CVE-2015-5522 : Fernando Munoz of NULLGroup.com CVE-2015-5523 : Fernando Munoz of NULLGroup.com Time Machine Available for: Mac OS X v10.6.8 and later Impact: A local attacker may gain access to keychain items Description: An issue existed in backups by the Time Machine framework. This issue was addressed through improved coverage of Time Machine backups. CVE-ID CVE-2015-5854 : Jonas Magazinius of Assured AB Note: OS X El Capitan 10.11 includes the security content of Safari 9: https://support.apple.com/kb/HT205265. OS X El Capitan 10.11 may be obtained from the Mac App Store: http://www.apple.com/support/downloads/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJWDB2wAAoJEBcWfLTuOo7t0sYP/2L3JOGPkHH8XUh2YHpu5qaw S5F2v+SRpWleKQBVsGZ7oA8PV0rBTzEkzt8K1tNxYmxEqL9f/TpRiGoforn89thO /hOtmVOfUcBjPZ4XKwMVzycfSMC9o6LxWTLEKDVylE+F+5jkXafOC9QaqD11dxX6 QhENkpS1BwrKhyaSVxEcgBQtZM9aTsVdZ78rTCb9XTn6gDnvs8NfIQquFOnaQT54 YJ36e5UcUsnyBIol+yGDbC3ZEhzSVIGE5/8/NFlFfRXLgnJArxD8lqz8WdfU9fop hpT/dDqqAdYbRcW1ihcG1haiNHgP9yQCY5jRNfttb+Tc/kIi/QmPkEO0QS8Ygt/O c3sUbNulr1LCinymFVwx16CM1DplGS/GmBL18BAEBnL6yi9tEhYDynZWLSEa37VR 8q802rXRSF10Wct9/kEeR4HgY/1k0KK/4Uddm3c0YyOU21ya7NAhoHGwmDa9g11r N1TniOK8tPiCGjRNOJwuF6DKxD9L3Fv44bVlxAarGUGYkICqzaNS+bgKI1aQNahT fJ91x5uKD4+L9v9c5slkoDIvWqIhO9oyuxgnmC5GstkwFplFXSOklLkTktjLGNn1 nJq8cPnZ/3E1RXTEwVhGljYw5pdZHNx98XmLomGrPqVlZfjGURK+5AXdf2pOlt2e g6jld/w5tPuCFhGucE7Z =XciV -----END PGP SIGNATURE----- . Background ========== Bash is the standard GNU Bourne Again SHell. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-shells/bash < 4.2_p52 *>= 3.1_p22 *>= 3.2_p56 *>= 4.0_p43 *>= 4.1_p16 >= 4.2_p52 Description =========== Florian Weimer, Todd Sabin, Michal Zalewski et al. discovered further parsing flaws in Bash. The unaffected Gentoo packages listed in this GLSA contain the official patches to fix the issues tracked as CVE-2014-6277, CVE-2014-7186, and CVE-2014-7187. Furthermore, the official patch known as "function prefix patch" is included which prevents the exploitation of CVE-2014-6278. Workaround ========== There is no known workaround at this time. Resolution ========== All Bash 3.1 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-shells/bash-3.1_p22:3.1" All Bash 3.2 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-shells/bash-3.2_p56:3.2" All Bash 4.0 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-shells/bash-4.0_p43:4.0" All Bash 4.1 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-shells/bash-4.1_p16:4.1" All Bash 4.2 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-shells/bash-4.2_p52" References ========== [ 1 ] CVE-2014-6277 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6277 [ 2 ] CVE-2014-6278 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-6278 [ 3 ] CVE-2014-7186 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7186 [ 4 ] CVE-2014-7187 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7187 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201410-01.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. License ======= Copyright 2014 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . This issue does not affect OS X Yosemite systems. The App Store process could log Apple ID credentials in the log when additional logging was enabled. CVE-ID CVE-2014-4499 : Sten Petersen CoreGraphics Available for: OS X Yosemite v10.10 and v10.10.1 Impact: Some third-party applications with non-secure text entry and mouse events may log those events Description: Due to the combination of an uninitialized variable and an application's custom allocator, non-secure text entry and mouse events may have been logged. This issue did not affect systems prior to OS X Yosemite. This issue does not affect OS X Yosemite systems. This issue was addressed by not granting write permissions as a side-effect of some custom cache modes. Serna of the Google Security Team CVE-2014-4419 : Fermin J. Serna of the Google Security Team CVE-2014-4420 : Fermin J. Serna of the Google Security Team CVE-2014-4421 : Fermin J. Responses containing an OSBundleMachOHeaders key may have included kernel addresses, which may aid in bypassing address space layout randomization protection. This issue does not affect OS X Yosemite v10.10 or later. CVE-ID CVE-2014-8839 : John Whitehead of The New York Times, Frode Moe of LastFriday.no Spotlight Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10 and v10.10.1 Impact: Spotlight may save unexpected information to an external hard drive Description: An issue existed in Spotlight where memory contents may have been written to external hard drives when indexing. A user performing a Spotlight query may have been shown search results referencing files for which they don't have sufficient privileges to read. This update removes such extraneous information that may have been present in printing preference files. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emr_na-c04512907 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c04512907 Version: 1 HPSBMU03217 rev.1 - HP Vertica Analytics Platform running Bash Shell, Remote Code Execution NOTICE: The information in this Security Bulletin should be acted upon as soon as possible. Release Date: 2014-12-16 Last Updated: 2014-12-16 Potential Security Impact: Remote code execution Source: Hewlett-Packard Company, HP Software Security Response Team VULNERABILITY SUMMARY A potential security vulnerability has been identified with HP Vertica. References: CVE-2014-6271 CVE-2014-6277 CVE-2014-6278 CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 SSRT101827 SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed. HP Vertica AMI's and Virtual Machines prior to v7.1.1-0. CVSS 2.0 Base Metrics =========================================================== Reference Base Vector Base Score CVE-2014-6271 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2104-6277 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2104-6278 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2014-7169 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2014-7186 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 CVE-2014-7187 (AV:N/AC:L/Au:N/C:C/I:C/A:C) 10.0 =========================================================== Information on CVSS is documented in HP Customer Notice: HPSN-2008-002 RESOLUTION We recommend installing Vertica v7.1.1-0 or subsequent, or manually installing a new version of Bash, such as Bash43-027. HP has released the following updates to resolve this vulnerability for HP Vertica products. Update to the latest VM image available at: https://my.vertica.com For customers using the AMI version HP Vertica Analytics platform, please install the latest image available at Amazon. Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information. To get the security-alert PGP key, please send an e-mail message as follows: To: security-alert@hp.com Subject: get key Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email: http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG &jumpid=in_SC-GEN__driverITRC&topiccode=ITRC On the web page: ITRC security bulletins and patch sign-up Under Step1: your ITRC security bulletins and patches - check ALL categories for which alerts are required and continue. Under Step2: your ITRC operating systems - verify your operating system selections are checked and save. To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php Log in on the web page: Subscriber's choice for Business: sign-in. On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections. To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do * The Software Product Category that this Security Bulletin relates to is represented by the 5th and 6th characters of the Bulletin number in the title: GN = HP General SW MA = HP Management Agents MI = Misc. 3rd Party SW MP = HP MPE/iX NS = HP NonStop Servers OV = HP OpenVMS PI = HP Printing & Imaging ST = HP Storage SW TL = HP Trusted Linux TU = HP Tru64 UNIX UX = HP-UX VV = HP VirtualVault System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions. "HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement." Copyright 2014 Hewlett-Packard Development Company, L.P. Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental, special or consequential damages including downtime cost; lost profits; damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Note: HP and the switch vendor recommend running an active version of Fabric OS (FOS) listed on the HP Single Point of Connectivity Knowledge (SPOCK) website ( http://h20272.www2.hp.com/ ) and applying the work-around information provided in the MITIGATION INFORMATION section below to protect HP StoreFabric B-series switches from this vulnerability. Fabric OS (FOS) v7.3.0b (This version will be available soon and this bulletin will revised at that time) The following focused fix FOS versions are available for the previously released versions and have been renamed to include an additional hexadecimal character appended to the FOS version on which it is based: FOS v7.2.1c1 FOS v7.2.0d6 FOS v7.1.2b1 FOS v7.1.1c1 FOS v7.1.0cb FOS v7.0.2e1 FOS v7.0.0d1 FOS v6.4.3f3 FOS v6.4.2a3 FOS v6.2.2f9 MITIGATION INFORMATION HP recommends the following steps to reduce the risk of this vulnerability: - Place the HP StoreFabric SAN switch and other data center critical infrastructure behind a firewall to disallow access from the Internet. - Change all HP StoreFabric switch default account passwords, including the root passwords, from the default factory passwords. - Examine the list of accounts, including ones on the switch and those existing on remote authentication servers such as RADIUS, LDAP, and TACAS+, to ensure only necessary personnel can gain access to HP StoreFabric FOS switches. Delete guest accounts and temporary accounts created for one-time usage needs. - Utilize FOS password policy management to strengthen the complexity, age, and history requirements of switch account passwords. HISTORY Version:1 (rev.1) - 16 October 2014 Initial release Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy. For other issues about the content of this Security Bulletin, send e-mail to security-alert@hp.com

Trust: 3.87

sources: NVD: CVE-2014-6277 // JVNDB: JVNDB-2014-004431 // CERT/CC: VU#252743 // BID: 70165 // PACKETSTORM: 128716 // PACKETSTORM: 128764 // PACKETSTORM: 128606 // PACKETSTORM: 128567 // PACKETSTORM: 129069 // VULMON: CVE-2014-6277 // PACKETSTORM: 129070 // PACKETSTORM: 133803 // PACKETSTORM: 128563 // PACKETSTORM: 130132 // PACKETSTORM: 128763 // PACKETSTORM: 129617 // PACKETSTORM: 128760 // PACKETSTORM: 129067

AFFECTED PRODUCTS

vendor:gnumodel:bashscope:eqversion:1.14.7

Trust: 1.6

vendor:gnumodel:bashscope:eqversion:2.01

Trust: 1.6

vendor:gnumodel:bashscope:eqversion:2.0

Trust: 1.6

vendor:gnumodel:bashscope:eqversion:1.14.4

Trust: 1.6

vendor:gnumodel:bashscope:eqversion:1.14.1

Trust: 1.6

vendor:gnumodel:bashscope:eqversion:1.14.0

Trust: 1.6

vendor:gnumodel:bashscope:eqversion:1.14.6

Trust: 1.6

vendor:gnumodel:bashscope:eqversion:1.14.2

Trust: 1.6

vendor:gnumodel:bashscope:eqversion:1.14.3

Trust: 1.6

vendor:gnumodel:bashscope:eqversion:1.14.5

Trust: 1.6

vendor:gnumodel:bashscope:eqversion:3.2.48

Trust: 1.3

vendor:gnumodel:bashscope:eqversion:4.0

Trust: 1.3

vendor:gnumodel:bashscope:eqversion:3.2

Trust: 1.3

vendor:gnumodel:bashscope:eqversion:4.2

Trust: 1.3

vendor:gnumodel:bashscope:eqversion:3.0.16

Trust: 1.3

vendor:gnumodel:bashscope:eqversion:4.1

Trust: 1.3

vendor:gnumodel:bashscope:eqversion:3.0

Trust: 1.3

vendor:gnumodel:bashscope:eqversion:2.03

Trust: 1.0

vendor:gnumodel:bashscope:eqversion:2.01.1

Trust: 1.0

vendor:gnumodel:bashscope:eqversion:2.02.1

Trust: 1.0

vendor:gnumodel:bashscope:eqversion:2.02

Trust: 1.0

vendor:gnumodel:bashscope:eqversion:3.1

Trust: 1.0

vendor:gnumodel:bashscope:eqversion:2.04

Trust: 1.0

vendor:gnumodel:bashscope:eqversion:4.3

Trust: 1.0

vendor:gnumodel:bashscope:eqversion:2.05

Trust: 1.0

vendor:applemodel: - scope: - version: -

Trust: 0.8

vendor:avayamodel: - scope: - version: -

Trust: 0.8

vendor:barracudamodel: - scope: - version: -

Trust: 0.8

vendor:blue coatmodel: - scope: - version: -

Trust: 0.8

vendor:centosmodel: - scope: - version: -

Trust: 0.8

vendor:check pointmodel: - scope: - version: -

Trust: 0.8

vendor:ciscomodel: - scope: - version: -

Trust: 0.8

vendor:cygwinmodel: - scope: - version: -

Trust: 0.8

vendor:d linkmodel: - scope: - version: -

Trust: 0.8

vendor:debian gnu linuxmodel: - scope: - version: -

Trust: 0.8

vendor:dell computermodel: - scope: - version: -

Trust: 0.8

vendor:extrememodel: - scope: - version: -

Trust: 0.8

vendor:f5model: - scope: - version: -

Trust: 0.8

vendor:fedoramodel: - scope: - version: -

Trust: 0.8

vendor:fireeyemodel: - scope: - version: -

Trust: 0.8

vendor:fortinetmodel: - scope: - version: -

Trust: 0.8

vendor:gnu bashmodel: - scope: - version: -

Trust: 0.8

vendor:gentoo linuxmodel: - scope: - version: -

Trust: 0.8

vendor:hewlett packardmodel: - scope: - version: -

Trust: 0.8

vendor:ibmmodel: - scope: - version: -

Trust: 0.8

vendor:junipermodel: - scope: - version: -

Trust: 0.8

vendor:mageiamodel: - scope: - version: -

Trust: 0.8

vendor:mcafeemodel: - scope: - version: -

Trust: 0.8

vendor:monroemodel: - scope: - version: -

Trust: 0.8

vendor:necmodel: - scope: - version: -

Trust: 0.8

vendor:niksunmodel: - scope: - version: -

Trust: 0.8

vendor:netappmodel: - scope: - version: -

Trust: 0.8

vendor:novellmodel: - scope: - version: -

Trust: 0.8

vendor:oraclemodel: - scope: - version: -

Trust: 0.8

vendor:palo altomodel: - scope: - version: -

Trust: 0.8

vendor:qnap securitymodel: - scope: - version: -

Trust: 0.8

vendor:red hatmodel: - scope: - version: -

Trust: 0.8

vendor:suse linuxmodel: - scope: - version: -

Trust: 0.8

vendor:slackware linuxmodel: - scope: - version: -

Trust: 0.8

vendor:sophosmodel: - scope: - version: -

Trust: 0.8

vendor:trend micromodel: - scope: - version: -

Trust: 0.8

vendor:ubuntumodel: - scope: - version: -

Trust: 0.8

vendor:vmwaremodel: - scope: - version: -

Trust: 0.8

vendor:xirrusmodel: - scope: - version: -

Trust: 0.8

vendor:gnumodel:bashscope:lteversion:4.3 bash43-026

Trust: 0.8

vendor:applemodel:mac osscope:eqversion:x10.1.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.2

Trust: 0.3

vendor:avayamodel:ip deskphonescope:eqversion:96x16.2

Trust: 0.3

vendor:xeroxmodel:colorqubescope:eqversion:9302

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0.4

Trust: 0.3

vendor:ciscomodel:network analysis modulescope:eqversion:0

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:6.2

Trust: 0.3

vendor:xeroxmodel:workcentrescope:eqversion:7228

Trust: 0.3

vendor:mcafeemodel:email gatewayscope:eqversion:7.0

Trust: 0.3

vendor:gnumodel:bashscope:eqversion:3.00.0(2)

Trust: 0.3

vendor:xeroxmodel:workcentrescope:eqversion:7238

Trust: 0.3

vendor:ciscomodel:digital media managerscope:eqversion:5.0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.9

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:5

Trust: 0.3

vendor:redmodel:hat enterprise linux long life serverscope:eqversion:5.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.7

Trust: 0.3

vendor:mcafeemodel:email gateway hotfixscope:eqversion:6.7.21

Trust: 0.3

vendor:cosmicperlmodel:directory proscope:eqversion:10.0.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2

Trust: 0.3

vendor:ciscomodel:emergency responderscope:eqversion:1.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.03

Trust: 0.3

vendor:ibmmodel:aixscope:eqversion:5.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1

Trust: 0.3

vendor:ubuntumodel:linux amd64scope:eqversion:10.04

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.9

Trust: 0.3

vendor:gnumodel:bashscope:eqversion:3.1.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.8

Trust: 0.3

vendor:xeroxmodel:colorqubescope:eqversion:9301

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1.4

Trust: 0.3

vendor:xeroxmodel:phaserscope:eqversion:78000

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1.3

Trust: 0.3

vendor:redmodel:hat enterprise linux hpc nodescope:eqversion:6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.2

Trust: 0.3

vendor:ubuntumodel:linux i386scope:eqversion:10.04

Trust: 0.3

vendor:ibmmodel:ds8000scope:eqversion:0

Trust: 0.3

vendor:ciscomodel:unified ip phonescope:eqversion:0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.8

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.7

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.4

Trust: 0.3

vendor:avayamodel:ip deskphonescope:eqversion:96x16

Trust: 0.3

vendor:gnumodel:bash rc1scope:eqversion:4.0

Trust: 0.3

vendor:xeroxmodel:workcentrescope:eqversion:7232

Trust: 0.3

vendor:redmodel:hat enterprise linux serverscope:eqversion:5

Trust: 0.3

vendor:oraclemodel:vm virtualboxscope:eqversion:3.2

Trust: 0.3

vendor:xeroxmodel:workcentrescope:eqversion:7242

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.3

Trust: 0.3

vendor:ciscomodel:digital media managerscope:eqversion:0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.8

Trust: 0.3

vendor:xeroxmodel:phaserscope:eqversion:67000

Trust: 0.3

vendor:xeroxmodel:colorqubescope:eqversion:9393

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.5

Trust: 0.3

vendor:ciscomodel:gss 4492r global site selectorscope:eqversion:0

Trust: 0.3

vendor:oraclemodel:enterprise linuxscope:eqversion:6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0.1

Trust: 0.3

vendor:ubuntumodel:linux sparcscope:eqversion:10.04

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.10

Trust: 0.3

vendor:ciscomodel:wide area application servicesscope:eqversion:0

Trust: 0.3

vendor:xeroxmodel:colorqubescope:eqversion:9303

Trust: 0.3

vendor:redmodel:hat enterprise linux workstationscope:eqversion:6

Trust: 0.3

vendor:gentoomodel:linuxscope: - version: -

Trust: 0.3

vendor:mcafeemodel:email gateway hotfixscope:eqversion:6.7.22

Trust: 0.3

vendor:ubuntumodel:linux powerpcscope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux lts i386scope:eqversion:12.04

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.1.2

Trust: 0.3

vendor:xeroxmodel:workcentrescope:eqversion:7235

Trust: 0.3

vendor:oraclemodel:vm virtualboxscope:eqversion:3.1

Trust: 0.3

vendor:mcafeemodel:email gateway patchscope:eqversion:7.01

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.2

Trust: 0.3

vendor:ubuntumodel:linux armscope:eqversion:10.04

Trust: 0.3

vendor:ubuntumodel:linux lts amd64scope:eqversion:12.04

Trust: 0.3

vendor:ibmmodel:aixscope:eqversion:7.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.7

Trust: 0.3

vendor:xeroxmodel:workcentrescope:eqversion:7245

Trust: 0.3

vendor:ciscomodel:unified contact center expressscope:eqversion:0

Trust: 0.3

vendor:sunmodel:solarisscope:eqversion:11

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.0.2

Trust: 0.3

vendor:redhatmodel:enterprise linuxscope:eqversion:5.0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.8

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.6.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.7

Trust: 0.3

vendor:ciscomodel:show and sharescope:eqversion:5(2)

Trust: 0.3

vendor:ciscomodel:mdsscope:eqversion:0

Trust: 0.3

vendor:redhatmodel:enterprise linux clientscope:eqversion:5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.5

Trust: 0.3

vendor:ibmmodel:aixscope:eqversion:6.1

Trust: 0.3

vendor:redmodel:hat enterprise linux serverscope:eqversion:6

Trust: 0.3

vendor:oraclemodel:linuxscope:eqversion:5

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.3.4

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.2.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.5.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.3

Trust: 0.3

vendor:hpmodel:insight controlscope:eqversion:0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.4.11

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.7.1

Trust: 0.3

sources: CERT/CC: VU#252743 // BID: 70165 // JVNDB: JVNDB-2014-004431 // CNNVD: CNNVD-201409-1037 // NVD: CVE-2014-6277

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-6277
value: HIGH

Trust: 1.0

NVD: CVE-2014-6277
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201409-1037
value: CRITICAL

Trust: 0.6

VULMON: CVE-2014-6277
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2014-6277
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

sources: VULMON: CVE-2014-6277 // JVNDB: JVNDB-2014-004431 // CNNVD: CNNVD-201409-1037 // NVD: CVE-2014-6277

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.8

sources: JVNDB: JVNDB-2014-004431 // NVD: CVE-2014-6277

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 128563 // CNNVD: CNNVD-201409-1037

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201409-1037

CONFIGURATIONS

sources: JVNDB: JVNDB-2014-004431

EXPLOIT AVAILABILITY

sources: VULMON: CVE-2014-6277

PATCH

title:APPLE-SA-2015-01-27-4url:http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html

Trust: 0.8

title:APPLE-SA-2015-09-30-3 OS X El Capitan 10.11url:http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html

Trust: 0.8

title:HT205267url:https://support.apple.com/en-us/HT205267

Trust: 0.8

title:HT204244url:http://support.apple.com/en-us/HT204244

Trust: 0.8

title:HT204244url:http://support.apple.com/ja-jp/HT204244

Trust: 0.8

title:HT205267url:http://support.apple.com/ja-jp/HT205267

Trust: 0.8

title:bash-3.2-33.AXS3.4 url:https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=3918

Trust: 0.8

title:bash-4.1.2-15.AXS4.2 url:https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=3919

Trust: 0.8

title:cisco-sa-20140926-bashurl:http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash

Trust: 0.8

title:CTX200223url:https://support.citrix.com/article/CTX200223

Trust: 0.8

title:CTX200217url:https://support.citrix.com/article/CTX200217

Trust: 0.8

title:GNU Bashurl:http://www.gnu.org/software/bash/

Trust: 0.8

title:HPSBMU03143 SSRT101761url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04479536

Trust: 0.8

title:HPSBMU03246 SSRT101743url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04558068

Trust: 0.8

title:HPSBMU03182 SSRT101787url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04497042

Trust: 0.8

title:HPSBST03122 SSRT101717url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04471532

Trust: 0.8

title:HPSBMU03144 SSRT101762url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04479492

Trust: 0.8

title:HPSBST03154 SSRT101747url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04487558

Trust: 0.8

title:HPSBHF03125 SSRT101724url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04471538

Trust: 0.8

title:HPSBST03129 SSRT101760url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04478866

Trust: 0.8

title:HPSBST03181 SSRT101811url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04496383

Trust: 0.8

title:HPSBGN03233url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04540692

Trust: 0.8

title:HPSBGN03138 SSRT101755url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04475942

Trust: 0.8

title:HPSBGN03142 SSRT101764url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04479402

Trust: 0.8

title:HPSBST03155 SSRT101747url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04487573

Trust: 0.8

title:HPSBMU03217 SSRT101827url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04512907

Trust: 0.8

title:HPSBGN03141 SSRT101763url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04479398

Trust: 0.8

title:HPSBMU03165 SSRT101783url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04497075

Trust: 0.8

title:HPSBMU03220 SSRT101819url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04518183

Trust: 0.8

title:HPSBHF03146 SSRT101765url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04479601

Trust: 0.8

title:HPSBST03157 SSRT101718url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04488200

Trust: 0.8

title:HPSBMU03236 SSRT101830url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04552143

Trust: 0.8

title:HPSBHF03145 SSRT101765url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04479505

Trust: 0.8

title:HPSBMU03245 SSRT101742url:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c04556845

Trust: 0.8

title:1685604url:http://www-01.ibm.com/support/docview.wss?uid=swg21685604

Trust: 0.8

title:1685541url:http://www-01.ibm.com/support/docview.wss?uid=swg21685541

Trust: 0.8

title:1685914url:http://www-01.ibm.com/support/docview.wss?uid=swg21685914

Trust: 0.8

title:S1004915url:http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004915

Trust: 0.8

title:1685733url:http://www-01.ibm.com/support/docview.wss?uid=swg21685733

Trust: 0.8

title:1685749url:http://www-01.ibm.com/support/docview.wss?uid=swg21685749

Trust: 0.8

title:1686131url:http://www-01.ibm.com/support/docview.wss?uid=swg21686131

Trust: 0.8

title:T1021279url:http://www-01.ibm.com/support/docview.wss?uid=isg3T1021279

Trust: 0.8

title:MIGR-5096315url:http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315

Trust: 0.8

title:S1004897url:http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897

Trust: 0.8

title:1685433url:http://www-01.ibm.com/support/docview.wss?uid=swg21685433

Trust: 0.8

title:T1021272url:http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272

Trust: 0.8

title:S1004898url:http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898

Trust: 0.8

title:1685522url:http://www-01.ibm.com/support/docview.wss?uid=swg21685522

Trust: 0.8

title:S1004879url:http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004879

Trust: 0.8

title:1686479url:http://www-01.ibm.com/support/docview.wss?uid=swg21686479

Trust: 0.8

title:1686493url:http://www-01.ibm.com/support/docview.wss?uid=swg21686493

Trust: 0.8

title:1686299url:http://www-01.ibm.com/support/docview.wss?uid=swg21686299

Trust: 0.8

title:1686635url:http://www-01.ibm.com/support/docview.wss?uid=swg21686635

Trust: 0.8

title:1685798url:http://www-01.ibm.com/support/docview.wss?uid=swg21685798

Trust: 0.8

title:アライドテレシス株式会社からの情報url:http://jvn.jp/vu/JVNVU97219505/522154/index.html

Trust: 0.8

title:OES11 SP2, OES11SP1, OES2 SP3 vulnerability with GNU Bash Remote Code Execution (aka ShellShock) and Mozilla NSS vulnerabilitiesurl:http://www.novell.com/support/kb/doc.php?id=7015701

Trust: 0.8

title:ZENworks Configuration Management vulnerability with GNU Bash Remote Code Execution (aka ShellShock)url:http://www.novell.com/support/kb/doc.php?id=7015721

Trust: 0.8

title:AV14-003url:http://jpn.nec.com/security-info/av14-003.html

Trust: 0.8

title:ShellShock 101 - What you need to know and do, to ensure your systems are secureurl:https://www.suse.com/support/shellshock/

Trust: 0.8

title:ELSA-2014-3093url:http://linux.oracle.com/errata/ELSA-2014-3093

Trust: 0.8

title:ELSA-2014-3094url:http://linux.oracle.com/errata/ELSA-2014-3094

Trust: 0.8

title:Bash "Shellshock" Vulnerabilities - CVE-2014-7169url:http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html

Trust: 0.8

title:NAS-201410-05url:http://www.qnap.com/i/en/support/con_show.php?cid=61

Trust: 0.8

title:Bug 1141597url:https://bugzilla.redhat.com/show_bug.cgi?id=1141597

Trust: 0.8

title:Resolution for Bash Code Injection Vulnerability via Specially Crafted Environment Variables (CVE-2014-6271, CVE-2014-7169) in Red Hat Enterprise Linuxurl:https://access.redhat.com/solutions/1207723

Trust: 0.8

title:Bash specially-crafted environment variables code injection attackurl:https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

Trust: 0.8

title:GNU Bash 「OS コマンドインジェクション」の脆弱性について url:http://www.rtpro.yamaha.co.jp/RT/FAQ/Security/VU252743.html

Trust: 0.8

title:SA82url:https://bto.bluecoat.com/security-advisory/sa82

Trust: 0.8

title:SOL15629url:https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html

Trust: 0.8

title:Multiple vulnerabilities in Bashurl:https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_bash

Trust: 0.8

title:JSA10648url:https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648

Trust: 0.8

title:VMSA-2014-0010url:http://www.vmware.com/security/advisories/VMSA-2014-0010.html

Trust: 0.8

title:GNU bash の脆弱性に関する弊社調査・対応状況についてurl:http://www.iodata.jp/support/information/2014/bash/

Trust: 0.8

title:bashの脆弱性(CVE-2014-6271,CVE-2014-7169 他)によるHA8500への影響についてurl:http://www.hitachi.co.jp/products/it/server/security/info/vulnerable/bash_ha8500.html

Trust: 0.8

title:サーバ・クライアント製品 bashの脆弱性(CVE-2014-6271,CVE-2014-7169他)による影響についてurl:http://www.hitachi.co.jp/products/it/server/security/info/vulnerable/bash_cve20146271.html

Trust: 0.8

title:cisco-sa-20140926-bashurl:http://www.cisco.com/cisco/web/support/JP/112/1126/1126247_cisco-sa-20140926-bash-j.html

Trust: 0.8

title:GNU BashにおけるOSコマンドインジェクションの脆弱性url:http://buffalo.jp/support_s/s20141002.html

Trust: 0.8

title:TLSA-2014-10url:http://www.turbolinux.co.jp/security/2014/TLSA-2014-10j.html

Trust: 0.8

title:GNU Bash に OS コマンドインジェクションの脆弱性url:http://software.fujitsu.com/jp/security/vulnerabilities/jvn-97219505.html

Trust: 0.8

title:Arch Linux Issues: url:https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2014-6277

Trust: 0.1

title:Ubuntu Security Notice: bash vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-2380-1

Trust: 0.1

title:VMware Security Advisories: VMware product updates address critical Bash security vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=vmware_security_advisories&qid=86cb6b3955e100fdc9667a7ca916c772

Trust: 0.1

title:Symantec Security Advisories: SA82 : GNU Bash Shellshock Command Injection Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=symantec_security_advisories&qid=2b57ceaadfde2a8b03482273e1fd21ea

Trust: 0.1

title:Apple: OS X Yosemite v10.10.2 and Security Update 2015-001url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=64cbe709a7be49c91d8a8b0f43621640

Trust: 0.1

title:Tenable Security Advisories: [R7] Tenable Appliance Affected by GNU bash 'Shellshock' Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=tenable_security_advisories&qid=TNS-2014-07

Trust: 0.1

title:Citrix Security Bulletins: Citrix XenServer Shellshock Security Updateurl:https://vulmon.com/vendoradvisory?qidtp=citrix_security_bulletins&qid=64ae0aae8269062686789e3a3fa1d2bf

Trust: 0.1

title:Citrix Security Bulletins: Citrix Security Advisory for GNU Bash Shellshock Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=citrix_security_bulletins&qid=73443a6db89dc66fc6bcb49f85bfd1ab

Trust: 0.1

title:Apple: OS X El Capitan v10.11url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=e88bab658248444f5dffc23fd95859e7

Trust: 0.1

title:patch-bash-shellshockurl:https://github.com/jdauphant/patch-bash-shellshock

Trust: 0.1

title:macosx-bash-92-shellshock-patchedurl:https://github.com/ido/macosx-bash-92-shellshock-patched

Trust: 0.1

title:w-testurl:https://github.com/inspirion87/w-test

Trust: 0.1

title:shellshockFixOSXurl:https://github.com/opragel/shellshockFixOSX

Trust: 0.1

title:shocktrooperurl:https://github.com/EvanK/shocktrooper

Trust: 0.1

title:ShellShockHunterurl:https://github.com/MrCl0wnLab/ShellShockHunter

Trust: 0.1

title:Xpl-SHELLSHOCK-Ch3ckurl:https://github.com/googleinurl/Xpl-SHELLSHOCK-Ch3ck

Trust: 0.1

title:bashcheckurl:https://github.com/hannob/bashcheck

Trust: 0.1

title:shellshocker-pocsurl:https://github.com/mubix/shellshocker-pocs

Trust: 0.1

title:LinuxFlawurl:https://github.com/mudongliang/LinuxFlaw

Trust: 0.1

title:afl-cveurl:https://github.com/mrash/afl-cve

Trust: 0.1

title:Threatposturl:https://threatpost.com/researcher-takes-wraps-off-two-undisclosed-shellshock-vulnerabilities-in-bash/108674/

Trust: 0.1

sources: VULMON: CVE-2014-6277 // JVNDB: JVNDB-2014-004431

EXTERNAL IDS

db:NVDid:CVE-2014-6277

Trust: 4.1

db:JVNid:JVN55667175

Trust: 1.9

db:JVNDBid:JVNDB-2014-000126

Trust: 1.9

db:CERT/CCid:VU#252743

Trust: 1.7

db:PACKETSTORMid:128567

Trust: 1.2

db:SECUNIAid:60325

Trust: 1.1

db:SECUNIAid:61065

Trust: 1.1

db:SECUNIAid:61780

Trust: 1.1

db:SECUNIAid:61603

Trust: 1.1

db:SECUNIAid:61287

Trust: 1.1

db:SECUNIAid:61643

Trust: 1.1

db:SECUNIAid:60433

Trust: 1.1

db:SECUNIAid:61565

Trust: 1.1

db:SECUNIAid:61312

Trust: 1.1

db:SECUNIAid:61703

Trust: 1.1

db:SECUNIAid:61503

Trust: 1.1

db:SECUNIAid:60034

Trust: 1.1

db:SECUNIAid:60044

Trust: 1.1

db:SECUNIAid:61328

Trust: 1.1

db:SECUNIAid:59907

Trust: 1.1

db:SECUNIAid:61129

Trust: 1.1

db:SECUNIAid:60024

Trust: 1.1

db:SECUNIAid:59961

Trust: 1.1

db:SECUNIAid:61633

Trust: 1.1

db:SECUNIAid:61128

Trust: 1.1

db:SECUNIAid:61313

Trust: 1.1

db:SECUNIAid:60055

Trust: 1.1

db:SECUNIAid:61291

Trust: 1.1

db:SECUNIAid:62343

Trust: 1.1

db:SECUNIAid:61641

Trust: 1.1

db:SECUNIAid:61857

Trust: 1.1

db:SECUNIAid:61816

Trust: 1.1

db:SECUNIAid:62312

Trust: 1.1

db:SECUNIAid:60193

Trust: 1.1

db:SECUNIAid:60063

Trust: 1.1

db:SECUNIAid:58200

Trust: 1.1

db:SECUNIAid:61654

Trust: 1.1

db:SECUNIAid:61550

Trust: 1.1

db:SECUNIAid:61283

Trust: 1.1

db:SECUNIAid:61485

Trust: 1.1

db:SECUNIAid:61471

Trust: 1.1

db:SECUNIAid:61442

Trust: 1.1

db:SECUNIAid:61552

Trust: 1.1

db:MCAFEEid:SB10085

Trust: 1.1

db:JUNIPERid:JSA10648

Trust: 1.1

db:JVNid:JVNVU97219505

Trust: 0.8

db:JVNid:JVNVU96447236

Trust: 0.8

db:JVNid:JVNVU97220341

Trust: 0.8

db:USCERTid:TA14-268A

Trust: 0.8

db:JVNDBid:JVNDB-2014-004431

Trust: 0.8

db:CNNVDid:CNNVD-201409-1037

Trust: 0.6

db:BIDid:70165

Trust: 0.3

db:EXPLOIT-DBid:35081

Trust: 0.1

db:VULMONid:CVE-2014-6277

Trust: 0.1

db:PACKETSTORMid:128716

Trust: 0.1

db:PACKETSTORMid:128764

Trust: 0.1

db:PACKETSTORMid:128606

Trust: 0.1

db:PACKETSTORMid:129069

Trust: 0.1

db:PACKETSTORMid:129067

Trust: 0.1

db:PACKETSTORMid:129070

Trust: 0.1

db:PACKETSTORMid:133803

Trust: 0.1

db:PACKETSTORMid:128563

Trust: 0.1

db:PACKETSTORMid:130132

Trust: 0.1

db:PACKETSTORMid:128763

Trust: 0.1

db:PACKETSTORMid:129617

Trust: 0.1

db:PACKETSTORMid:128760

Trust: 0.1

sources: CERT/CC: VU#252743 // VULMON: CVE-2014-6277 // BID: 70165 // JVNDB: JVNDB-2014-004431 // PACKETSTORM: 128716 // PACKETSTORM: 128764 // PACKETSTORM: 128606 // PACKETSTORM: 128567 // PACKETSTORM: 129069 // PACKETSTORM: 129067 // PACKETSTORM: 129070 // PACKETSTORM: 133803 // PACKETSTORM: 128563 // PACKETSTORM: 130132 // PACKETSTORM: 128763 // PACKETSTORM: 129617 // PACKETSTORM: 128760 // CNNVD: CNNVD-201409-1037 // NVD: CVE-2014-6277

REFERENCES

url:http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html

Trust: 2.5

url:https://kb.bluecoat.com/index?page=content&id=sa82

Trust: 1.9

url:http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20140926-bash

Trust: 1.9

url:https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html

Trust: 1.9

url:https://kc.mcafee.com/corporate/index?page=content&id=sb10085

Trust: 1.9

url:http://jvndb.jvn.jp/jvndb/jvndb-2014-000126

Trust: 1.9

url:https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

Trust: 1.6

url:https://nvd.nist.gov/vuln/detail/cve-2014-6277

Trust: 1.3

url:http://www.ubuntu.com/usn/usn-2380-1

Trust: 1.2

url:https://www.suse.com/support/shellshock/

Trust: 1.1

url:http://support.novell.com/security/cve/cve-2014-6277.html

Trust: 1.1

url:http://secunia.com/advisories/61641

Trust: 1.1

url:http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html

Trust: 1.1

url:http://secunia.com/advisories/61485

Trust: 1.1

url:http://secunia.com/advisories/59907

Trust: 1.1

url:http://secunia.com/advisories/61654

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=swg21685749

Trust: 1.1

url:http://packetstormsecurity.com/files/128567/ca-technologies-gnu-bash-shellshock.html

Trust: 1.1

url:http://secunia.com/advisories/61565

Trust: 1.1

url:http://www.novell.com/support/kb/doc.php?id=7015721

Trust: 1.1

url:http://www.vmware.com/security/advisories/vmsa-2014-0010.html

Trust: 1.1

url:http://secunia.com/advisories/61643

Trust: 1.1

url:http://secunia.com/advisories/61503

Trust: 1.1

url:https://kb.juniper.net/infocenter/index?page=content&id=jsa10648

Trust: 1.1

url:http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html

Trust: 1.1

url:http://secunia.com/advisories/61633

Trust: 1.1

url:http://secunia.com/advisories/61552

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=swg21685914

Trust: 1.1

url:http://secunia.com/advisories/61703

Trust: 1.1

url:http://secunia.com/advisories/61283

Trust: 1.1

url:http://secunia.com/advisories/61603

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=isg3t1021272

Trust: 1.1

url:http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00004.html

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141330468527613&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141345648114150&w=2

Trust: 1.1

url:https://support.citrix.com/article/ctx200217

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004879

Trust: 1.1

url:http://secunia.com/advisories/60034

Trust: 1.1

url:http://secunia.com/advisories/61816

Trust: 1.1

url:http://secunia.com/advisories/61128

Trust: 1.1

url:http://secunia.com/advisories/61313

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004898

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=swg21685733

Trust: 1.1

url:http://secunia.com/advisories/61442

Trust: 1.1

url:http://secunia.com/advisories/61287

Trust: 1.1

url:https://support.citrix.com/article/ctx200223

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=isg3t1021279

Trust: 1.1

url:http://secunia.com/advisories/60055

Trust: 1.1

url:http://secunia.com/advisories/61129

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004897

Trust: 1.1

url:http://secunia.com/advisories/61780

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=swg21686479

Trust: 1.1

url:http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=migr-5096315

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=swg21685541

Trust: 1.1

url:http://secunia.com/advisories/61471

Trust: 1.1

url:http://secunia.com/advisories/61328

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=ssg1s1004915

Trust: 1.1

url:http://secunia.com/advisories/58200

Trust: 1.1

url:http://secunia.com/advisories/61857

Trust: 1.1

url:http://secunia.com/advisories/60193

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=swg21685604

Trust: 1.1

url:http://secunia.com/advisories/61065

Trust: 1.1

url:http://secunia.com/advisories/61550

Trust: 1.1

url:http://secunia.com/advisories/60325

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=swg21686131

Trust: 1.1

url:http://secunia.com/advisories/61312

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=swg21686494

Trust: 1.1

url:http://secunia.com/advisories/60063

Trust: 1.1

url:http://secunia.com/advisories/61291

Trust: 1.1

url:http://secunia.com/advisories/60044

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=swg21686246

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=swg21686445

Trust: 1.1

url:https://supportcenter.checkpoint.com/supportcenter/portal?eventsubmit_dogoviewsolutiondetails=&solutionid=sk102673&src=securityalerts

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=swg21687079

Trust: 1.1

url:http://www-01.ibm.com/support/docview.wss?uid=isg3t1021361

Trust: 1.1

url:http://secunia.com/advisories/60433

Trust: 1.1

url:http://secunia.com/advisories/60024

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141383353622268&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141383304022067&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141383244821813&w=2

Trust: 1.1

url:http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.html

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141450491804793&w=2

Trust: 1.1

url:http://jvn.jp/en/jp/jvn55667175/index.html

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141383081521087&w=2

Trust: 1.1

url:http://www.qnap.com/i/en/support/con_show.php?cid=61

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141383026420882&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141383196021590&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141383465822787&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141577137423233&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141577241923505&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141576728022234&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141577297623641&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141585637922673&w=2

Trust: 1.1

url:http://secunia.com/advisories/62312

Trust: 1.1

url:http://secunia.com/advisories/59961

Trust: 1.1

url:http://secunia.com/advisories/62343

Trust: 1.1

url:http://linux.oracle.com/errata/elsa-2014-3093

Trust: 1.1

url:http://linux.oracle.com/errata/elsa-2014-3094

Trust: 1.1

url:http://lists.apple.com/archives/security-announce/2015/jan/msg00003.html

Trust: 1.1

url:http://support.apple.com/ht204244

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=142358026505815&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=142358078406056&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=142289270617409&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=141879528318582&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=142118135300698&w=2

Trust: 1.1

url:http://marc.info/?l=bugtraq&m=142721162228379&w=2

Trust: 1.1

url:http://www.mandriva.com/security/advisories?name=mdvsa-2015:164

Trust: 1.1

url:http://lists.apple.com/archives/security-announce/2015/sep/msg00008.html

Trust: 1.1

url:https://support.apple.com/ht205267

Trust: 1.1

url:https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us&docid=emr_na-c04518183

Trust: 1.1

url:https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us&docid=emr_na-c04497075

Trust: 1.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-6278

Trust: 1.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-7186

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2014-7187

Trust: 1.0

url:http://www.kb.cert.org/vuls/id/252743

Trust: 0.9

url:https://nvd.nist.gov/vuln/detail/cve-2014-7169

Trust: 0.9

url:https://nvd.nist.gov/vuln/detail/cve-2014-6271

Trust: 0.9

url:http://seclists.org/oss-sec/2014/q3/650

Trust: 0.8

url:https://access.redhat.com/articles/1200223

Trust: 0.8

url:http://seclists.org/oss-sec/2014/q3/688

Trust: 0.8

url:http://seclists.org/oss-sec/2014/q3/685

Trust: 0.8

url:http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html

Trust: 0.8

url:https://gist.github.com/anonymous/929d622f3b36b00c0be1

Trust: 0.8

url:https://www.dfranke.us/posts/2014-09-27-shell-shock-exploitation-vectors.html

Trust: 0.8

url:https://shellshocker.net/#

Trust: 0.8

url:http://support.apple.com/kb/ht6495

Trust: 0.8

url:https://www.barracuda.com/support/techalerts

Trust: 0.8

url:http://www.checkpoint.com/blog/protecting-shellshock/index.html

Trust: 0.8

url:http://securityadvisories.dlink.com/security/publication.aspx?name=sap10044

Trust: 0.8

url:https://www.debian.org/security/2014/dsa-3032

Trust: 0.8

url:http://learn.extremenetworks.com/rs/extreme/images/vn-2014-001-%20gnu%20bash%20threats%20-cve-2014-7169%20rev01.pdf

Trust: 0.8

url:http://fedoramagazine.org/shellshock-update-bash-packages-that-resolve-cve-2014-6271-and-cve-2014-7169-available/

Trust: 0.8

url:http://www.fortiguard.com/advisory/fg-ir-14-030/

Trust: 0.8

url:http://www.gentoo.org/security/en/glsa/glsa-201409-09.xml

Trust: 0.8

url:http://alerts.hp.com/r?2.1.3kt.2zr.15ee22.l8mgqe..n.ghvs.8f9a.bw89mq%5f%5fdbosfqk0

Trust: 0.8

url:http://kb.juniper.net/jsa10648

Trust: 0.8

url:http://jpn.nec.com/security-info/av14-003.html

Trust: 0.8

url:http://support.novell.com/security/cve/cve-2014-6271.html

Trust: 0.8

url:https://www.suse.com/support/kb/doc.php?id=7015702

Trust: 0.8

url:http://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.522193

Trust: 0.8

url:http://www.ubuntu.com/usn/usn-2362-1/

Trust: 0.8

url:http://kb.vmware.com/selfservice/microsites/search.do?language=en_us&cmd=displaykc&externalid=2090740

Trust: 0.8

url:http://pkgsrc.se/files.php?messageid=20140925202832.9ad9c98@cvs.netbsd.org

Trust: 0.8

url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-6277

Trust: 0.8

url:http://www.ipa.go.jp/security/ciadr/vul/20140926-bash.html

Trust: 0.8

url:https://www.jpcert.or.jp/at/2014/at140037.html

Trust: 0.8

url:http://jvn.jp/jp/jvn55667175/index.html

Trust: 0.8

url:http://jvn.jp/vu/jvnvu96447236/index.html

Trust: 0.8

url:http://jvn.jp/vu/jvnvu97219505/index.html

Trust: 0.8

url:http://jvn.jp/vu/jvnvu97220341/index.html

Trust: 0.8

url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-6277

Trust: 0.8

url:https://www.us-cert.gov/ncas/alerts/ta14-268a

Trust: 0.8

url:http://lcamtuf.blogspot.jp/2014/09/bash-bug-apply-unofficial-patch-now.html

Trust: 0.8

url:http://www.aratana.jp/security/detail.php?id=10

Trust: 0.8

url:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/

Trust: 0.8

url:https://h20564.www2.hp.com/portal/site/hpsc/public/kb/secbullarchive/

Trust: 0.7

url:http://h41183.www4.hp.com/signup_alerts.php?jumpid=hpsc_secbulletins

Trust: 0.7

url:http://www.gnu.org/software/bash/

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2104-6277

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2104-6278

Trust: 0.2

url:http://www.apple.com/support/downloads/

Trust: 0.2

url:https://www.apple.com/support/security/pgp/

Trust: 0.2

url:https://cwe.mitre.org/data/definitions/78.html

Trust: 0.1

url:https://www.exploit-db.com/exploits/35081/

Trust: 0.1

url:https://security.archlinux.org/cve-2014-6277

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://usn.ubuntu.com/2380-1/

Trust: 0.1

url:https://tmc.tippingpoint.com/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-0224

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/bash/4.2-2ubuntu2.6

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.5

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/bash/4.1-2ubuntu3.5

Trust: 0.1

url:https://www.ca.com

Trust: 0.1

url:https://support.ca.com/irj/portal/anonymous/phpsbpldgpg

Trust: 0.1

url:https://support.ca.com.

Trust: 0.1

url:http://www.hp.com/support/eslg3

Trust: 0.1

url:https://softwaresupport.hp.com/group/softwaresupport/search-result/-/facetsea

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-0287

Trust: 0.1

url:https://support.apple.com/kb/ht201222

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-0235

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-8146

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-0231

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-8080

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2331

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-1351

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-8090

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-9705

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-1352

Trust: 0.1

url:https://support.apple.com/en-

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-3951

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-8147

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-0232

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2301

Trust: 0.1

url:https://support.apple.com/kb/ht205265.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-8611

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-9427

Trust: 0.1

url:http://gpgtools.org

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-1855

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-2305

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-9425

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-3618

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-9709

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-0273

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-2532

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-9652

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2015-0286

Trust: 0.1

url:https://www.tencent.com)

Trust: 0.1

url:http://creativecommons.org/licenses/by-sa/2.5

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6277

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-7186

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-7187

Trust: 0.1

url:http://security.gentoo.org/

Trust: 0.1

url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2014-6278

Trust: 0.1

url:https://bugs.gentoo.org.

Trust: 0.1

url:http://security.gentoo.org/glsa/glsa-201410-01.xml

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4426

Trust: 0.1

url:http://support.apple.com/kb/ht1222

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4485

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4484

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-3567

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4421

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4483

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4491

Trust: 0.1

url:https://support.apple.com/kb/ht204243

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2011-2391

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4487

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4481

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4419

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4420

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4488

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4489

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-1595

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4498

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4497

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4460

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4492

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4499

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4389

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-3568

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4461

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4486

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4495

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-4371

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2014-3566

Trust: 0.1

url:http://support.openview.hp.com/selfsolve/document/km01194258

Trust: 0.1

url:http://h30046.www3.hp.com/driveralertprofile.php?regioncode=na&langcode=useng

Trust: 0.1

url:http://www.itrc.hp.com/service/cki/secbullarchive.do

Trust: 0.1

url:https://my.vertica.com

Trust: 0.1

url:http://h30046.www3.hp.com/subsignin.php

Trust: 0.1

url:http://h20272.www2.hp.com/

Trust: 0.1

sources: CERT/CC: VU#252743 // VULMON: CVE-2014-6277 // BID: 70165 // JVNDB: JVNDB-2014-004431 // PACKETSTORM: 128716 // PACKETSTORM: 128764 // PACKETSTORM: 128606 // PACKETSTORM: 128567 // PACKETSTORM: 129069 // PACKETSTORM: 129067 // PACKETSTORM: 129070 // PACKETSTORM: 133803 // PACKETSTORM: 128563 // PACKETSTORM: 130132 // PACKETSTORM: 128763 // PACKETSTORM: 129617 // PACKETSTORM: 128760 // CNNVD: CNNVD-201409-1037 // NVD: CVE-2014-6277

CREDITS

HP

Trust: 0.8

sources: PACKETSTORM: 128716 // PACKETSTORM: 128764 // PACKETSTORM: 129069 // PACKETSTORM: 129067 // PACKETSTORM: 129070 // PACKETSTORM: 128763 // PACKETSTORM: 129617 // PACKETSTORM: 128760

SOURCES

db:CERT/CCid:VU#252743
db:VULMONid:CVE-2014-6277
db:BIDid:70165
db:JVNDBid:JVNDB-2014-004431
db:PACKETSTORMid:128716
db:PACKETSTORMid:128764
db:PACKETSTORMid:128606
db:PACKETSTORMid:128567
db:PACKETSTORMid:129069
db:PACKETSTORMid:129067
db:PACKETSTORMid:129070
db:PACKETSTORMid:133803
db:PACKETSTORMid:128563
db:PACKETSTORMid:130132
db:PACKETSTORMid:128763
db:PACKETSTORMid:129617
db:PACKETSTORMid:128760
db:CNNVDid:CNNVD-201409-1037
db:NVDid:CVE-2014-6277

LAST UPDATE DATE

2024-11-08T20:46:55.252000+00:00


SOURCES UPDATE DATE

db:CERT/CCid:VU#252743date:2015-04-14T00:00:00
db:VULMONid:CVE-2014-6277date:2018-08-09T00:00:00
db:BIDid:70165date:2015-10-26T16:51:00
db:JVNDBid:JVNDB-2014-004431date:2015-12-24T00:00:00
db:CNNVDid:CNNVD-201409-1037date:2014-09-28T00:00:00
db:NVDid:CVE-2014-6277date:2018-08-09T01:29:01.437

SOURCES RELEASE DATE

db:CERT/CCid:VU#252743date:2014-09-25T00:00:00
db:VULMONid:CVE-2014-6277date:2014-09-27T00:00:00
db:BIDid:70165date:2014-09-27T00:00:00
db:JVNDBid:JVNDB-2014-004431date:2014-09-30T00:00:00
db:PACKETSTORMid:128716date:2014-10-16T13:33:00
db:PACKETSTORMid:128764date:2014-10-20T17:57:00
db:PACKETSTORMid:128606date:2014-10-09T23:44:16
db:PACKETSTORMid:128567date:2014-10-06T16:47:01
db:PACKETSTORMid:129069date:2014-11-12T18:13:47
db:PACKETSTORMid:129067date:2014-11-12T18:13:32
db:PACKETSTORMid:129070date:2014-11-12T18:13:53
db:PACKETSTORMid:133803date:2015-10-01T16:33:47
db:PACKETSTORMid:128563date:2014-10-06T16:37:31
db:PACKETSTORMid:130132date:2015-01-28T00:36:53
db:PACKETSTORMid:128763date:2014-10-20T17:55:00
db:PACKETSTORMid:129617date:2014-12-17T18:27:35
db:PACKETSTORMid:128760date:2014-10-20T17:03:00
db:CNNVDid:CNNVD-201409-1037date:2014-09-28T00:00:00
db:NVDid:CVE-2014-6277date:2014-09-27T22:55:02.660