NIKSUN Information for VU#252743

GNU Bash shell executes commands in exported functions in environment variables

Status

Affected

Vendor Statement

Information contained below is subject to change due to the evolving nature of
CVE-reported information & available fixes.

"ShellShock" CVE-2014-6271 & CVE-2014-7169 are now resolved in software patches
made available via NIKSUN SupportNet. NIKSUN has now produced software updates
for all supported product lines. We continue to observe activity on the NSON
(NIKSUN Security Observation Network) to produce current threat detections €“
more signatures may be released as we continuously observe behavior globally.
Current signatures should be downloaded & installed, available via SupportNet,
to get the most out of your NIKSUN security products.

The BASH component defect affecting the community-at-large is serious, but
unlike the Heartbleed defect, which generically affected many publically
available products in exactly the same way, Shellshock requires a specific set
of conditions to exist for exploitation.

NIKSUN is both a contributor to the open source community as well as a consumer
and is leveraging those relationships to bring this issue to a satisfactory
close.

"ShellShock" CVE-2014-6271 & CVE-2014-7169 are now resolved in software patches
made available via NIKSUN SupportNet. NIKSUN has now produced software updates
for all supported product lines, with additional work in progress on breaking
CVEs related to ShellShock exposed in the last few days €“ software currently
in a quality assurance cycle will become available this week for remaining CVEs
associated with ShellShock now that the global community has agreed on a
sustainable, supportable fix. We continue to observe activity on the NSON
(NIKSUN Security Observation Network) to produce current threat detections with
more signatures released as we continuously observe behavior globally. Current
signatures should be downloaded & installed, available via SupportNet, to get
the most out of your NIKSUN security products.

NIKSUN is committed to providing a rapid resolution to this issue while
ensuring quality, stability & completeness of a fix.

The list below is not a fully comprehensive version list

NIKOS Appliance 4.3.2.0
NIKOS Appliance 4.3.1.2
NIKOS Appliance 4.4.1.1
NIKOS Appliance 4.4.1.2
NIKOS Appliance 4.5.0.0_9
NIKOS Appliance 4.5.0.1

NetOmni 4.3.1.2
NetOmni 4.3.2.0
NetOmni 4.4.1.1
NetOmni 4.4.1.2
NetOmni 4.5.0.0
NetOmni 4.5.0.1
NetOmni 4.5.1.0

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

None

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.