CERT-In Advisory
CIAD-2014-0057
Remote Code Execution Vulnerability in GNU BASH (Shellshock Vulnerability)
Original Issue Date: September 26, 2014
Updated: October 11, 2014
Severity Rating: High
Systems Affected
Overview
A remote code execution vulnerability has been reported in GNU bash, which could allow an attacker to execute arbitrary code on targeted system.
Description
Bash or the "Bourne again shell" is a widely used command processor GNU software project utility on any UNIX based systems.
The vulnerability exists due to some flaws in bash functionality while evaluating specially formatted environment variables passed from another environment. The vulnerability could be exploited by a remote attacker by sending specially crafted packet to override or bypass environment restrictions to execute shell commands.
Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the targeted system.
Note: Check for any scanning attempts on TCP port 10000, a standard port used by "Webmin" - a web-based interface for system administration for Unix.
Solution
Apply appropriate patches as mentioned by various vendors
Vendor Information
CentOS
http://lists.centos.org/pipermail/centos/2014-September/146099.html
Debian
https://www.debian.org/security/2014/dsa-3032
RedHat
https://access.redhat.com/solutions/1207723
Ubuntu
http://www.ubuntu.com/usn/usn-2362-1/
Oracle
http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html
Juniper
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648
Cisco
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash
Bluecoat
https://kb.bluecoat.com/index?page=content&id=SA82
Apple
http://support.apple.com/downloads/
McAfee
https://kc.mcafee.com/corporate/index?page=content&id=SB10085
IBM
http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272
HP
http://h17007.www1.hp.com/docs/networking/alert/GNU-BASH_Security-Advisory.pdf
SUSE
https://www.suse.com/support/shellshock/
Webmin
http://www.webmin.com/changes-1.710.html
References
GNU
www.gnu.org/software/bash/
Redhat
https://access.redhat.com/security/cve/CVE-2014-6271
US-CERT
https://www.us-cert.gov/ncas/current-activity/2014/09/24/Bourne-Again-Shell-Bash-Remote-Code-Execution-Vulnerability
https://www.us-cert.gov/ncas/alerts/TA14-268A
Security Tracker
http://securitytracker.com/id/1030890
CVE Name
CVE-2014-6271
CVE-2014-7169
CVE-2014-6277
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|