what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Cisco Security Advisory 20140926-bash

Cisco Security Advisory 20140926-bash
Posted Sep 26, 2014
Authored by Cisco Systems | Site cisco.com

Cisco Security Advisory - On September 24, 2014, a vulnerability in the Bash shell was publicly announced. The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers. All versions of GNU Bash starting with version 1.14 are affected by this vulnerability and the specific impact is determined by the characteristics of the process using the Bash shell. In the worst case, an unauthenticated remote attacker would be able to execute commands on an affected server. However, in most cases involving Cisco products, exploitation of the vulnerability results in an authenticated attacker having the ability to execute commands for which they are not authorized. A number of Cisco products ship with or leverage an affected version of the Bash shell. This advisory will be updated as additional information becomes available. Cisco may release free software updates that address this vulnerability if a product is determined to be affected by this vulnerability.

tags | advisory, remote, web, shell, bash
systems | cisco
SHA-256 | 67983763ce5d1b5e462159463c83b03085fadbe2fc6b45584c12b6e1e3959da5

Cisco Security Advisory 20140926-bash

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

GNU Bash Environmental Variable Command Injection Vulnerability

Advisory ID: cisco-sa-20140926-bash

Revision 1.0

For Public Release 2014 September 26 01:00 UTC (GMT)

Summary
+======

On September 24, 2014, a vulnerability in the Bash shell was publicly announced. The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers.

All versions of GNU Bash starting with version 1.14 are affected by this vulnerability and the specific impact is determined by the characteristics of the process using the Bash shell. In the worst case, an unauthenticated remote attacker would be able to execute commands on an affected server. However, in most cases involving Cisco products, exploitation of the vulnerability results in an authenticated attacker having the ability to execute commands for which they are not authorized.

A number of Cisco products ship with or leverage an affected version of the Bash shell.

This advisory will be updated as additional information becomes available.

Cisco may release free software updates that address this vulnerability if a product is determined to be affected by this vulnerability.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash


-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org

iQIcBAEBAgAGBQJUJL6FAAoJEIpI1I6i1Mx3D+gP/RqX9nfbYoDMS2lexORWh/dj
tLGjfFWgCywYsKeldrtD0dcWNQTXb9GarDU0VW/vez3AinM/GVHYtoVv2GeXniTo
rVu5Y8iLsbr22qTxK9DWII/dfE4mhbhf7mva7b+Yw8l2YZ22YbW3/sDBfSV0oUYa
Oxof9tJq1/cweq3w6ZUAaLbQNe+DR6APgPzXfaJPL4m6FkbXvGMxveSW3XfIEODK
o7UGSF034veVgsKq68eS/DcIMLPPRykxd/YyrD/SEGkAiG0wrNCmDJLXe4vF2GPg
CoNZGQOUwRQqW1OY9nDCQJEpGmIj7/6Mpf94Cn9QFEHBWy5fQfQg4lh4aTWDs9GN
qdKNjiYM1KgMh+7sjzXjU5MXWyxsUgy2tErJ0OswJZi5p2bavtY3rNF1Hv1Wp62b
g4lJT4WUcQAmaySr+/vITfHPRYIn/m8964QIBP7Q2HRU96gHfvXSJMgTpjBHqi6s
YGtouL1F5aW31hT+sFCgIcxa2jaJJ50WgW1yuyU5zklhSr2n4vUmccbQr8Ihiv1/
wFs77a3XgJ2BXwa/esAt1Z+cn8LLZrpTuHeKim5uqft0MKmzpm+QGdNkqJVg1hM8
xPZiPDzSZZTthRp7hliRr707ueIGBa2RjTHa728BPL3kXd+nCgR3xeBLW+0LEfQp
nnr5XnWnPXWAIKDwL4dh
=HOcq
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close