search menu icon-carat-right cmu-wordmark

CERT Coordination Center


GNU Bash shell executes commands in exported functions in environment variables

Vulnerability Note VU#252743

Original Release Date: 2014-09-25 | Last Revised: 2015-04-14

Overview

GNU Bash 4.3 and earlier contains a command injection vulnerability that may allow remote code execution.

Description

UPDATE: New CVE-IDs added for incomplete patches. Additional resources added and vendor patch information updated.

CWE-78: OS Command Injection

Bash supports exporting of shell functions to other instances of bash using an environment variable. This environment variable is named by the function name and starts with a "() {" as the variable value in the function definition. When Bash reaches the end of the function definition, rather than ending execution it continues to process shell commands written after the end of the function. This vulnerability is especially critical because Bash is widespread on many types of devices (UNIX-like operating systems including Linux and Mac OS X), and because many network services utilize Bash, causing the vulnerability to be network exploitable. Any service or program that sets environment variables controlled by an attacker and calls Bash may be vulnerable.

Red Hat has developed the following test:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

The website shellshocker.net from the health IT team at Medical Informatics Engineering has developed several tests for websites and hosts and includes update information.

This vulnerability is being actively exploited.

Impact

A malicious attacker may be able to execute arbitrary code at the privilege level of the calling application.

Solution

Apply an Update
The first several set of patches (for CVE-2014-6271) do not completely resolve the vulnerability. CVE-2014-7169, CVE-2014-6277, CVE-2014-7186, and CVE 2014-7187 identify the remaining aspects of this vulnerability. Red Hat has provided a support article with updated information and workarounds.

CERT/CC has also included vendor patch information below when notified of an update.

Vendor Information

Many UNIX-like operating systems, including Linux distributions and Apple Mac OS X include Bash and are likely to be vulnerable. Contact your vendor for information about updates or patches. This Red Hat support article and blog post describe ways that Bash can be called from other programs, including network vectors such as CGI, SSH, and DHCP. Shell Shock Exploitation Vectors describes other ways this vulnerability could be exploited.

252743
Expand all

Apple Inc.

Notified:  September 25, 2014 Updated:  October 01, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://support.apple.com/kb/ht6495

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Avaya, Inc.

Notified:  September 25, 2014 Updated:  September 29, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

See the following URL for more information from the vendor.

Vendor References

https://downloads.avaya.com/css/P8/documents/100183009

Addendum

The Avaya Communications Server (CS) 1000 Rls 6 has been reported to be vulnerable.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Barracuda Networks

Notified:  September 25, 2014 Updated:  September 27, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://www.barracuda.com/support/techalerts

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Blue Coat Systems

Notified:  September 25, 2014 Updated:  September 27, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://kb.bluecoat.com/index?page=content&id=SA82

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CentOS

Updated:  September 27, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://lists.centos.org/pipermail/centos/2014-September/146099.html

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Check Point Software Technologies

Notified:  September 25, 2014 Updated:  September 27, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673 http://www.checkpoint.com/blog/protecting-shellshock/index.html

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Cisco Systems, Inc.

Notified:  September 25, 2014 Updated:  September 26, 2014

Statement Date:   September 26, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Cygwin

Updated:  September 26, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

https://cygwin.com/ml/cygwin-announce/2014-09/msg00033.html

If you have feedback, comments, or additional information about this vulnerability, please send us email.

D-Link Systems, Inc.

Notified:  September 25, 2014 Updated:  October 07, 2014

Status

  Affected

Vendor Statement

All D-Link Devices and Software have been cleared and are not affected by this
vulnerability. All D-Link Services have been audited for the use of bash shell
implementations. Based on the results of the audit we have applied appropriate
updates, if needed, to close this potential vulnerability.  D-Link continues
to monitor CERT incase of further issues are reported about the Bash Shell.
(Edited: 10/06/2014 15:52 PST)

Vendor Information

Please contact at: security@dlink.com

Vendor References

http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10044

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Debian GNU/Linux

Notified:  September 25, 2014 Updated:  September 27, 2014

Statement Date:   September 25, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://security-tracker.debian.org/tracker/source-package/bash https://www.debian.org/security/2014/dsa-3035 https://www.debian.org/security/2014/dsa-3032

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Dell Computer Corporation, Inc.

Updated:  September 27, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://support.software.dell.com/k1000/kb/133191

Addendum

Dell KACE systems use Bash.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Extreme Networks

Notified:  September 25, 2014 Updated:  October 01, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://learn.extremenetworks.com/rs/extreme/images/VN-2014-001-%20GNU%20Bash%20Threats%20-CVE-2014-7169%20rev01.pdf

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

F5 Networks, Inc.

Notified:  September 25, 2014 Updated:  September 26, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Fedora Project

Notified:  September 25, 2014 Updated:  September 27, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://fedoramagazine.org/shellshock-update-bash-packages-that-resolve-cve-2014-6271-and-cve-2014-7169-available/

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

FireEye

Updated:  October 02, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www.fireeye.com/resources/pdfs/support-notices/FireEye-Statement-About-Bash-Shellshock-Vulnerability-CVE-2014-6271-and-CVE-2014-7169.pdf

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Fortinet, Inc.

Notified:  September 25, 2014 Updated:  September 26, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www.fortiguard.com/advisory/FG-IR-14-030/

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

GNU Bash

Updated:  September 25, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://ftp.gnu.org/gnu/bash/bash-4.3-patches/

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Gentoo Linux

Notified:  September 25, 2014 Updated:  September 27, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www.gentoo.org/security/en/glsa/glsa-201409-09.xml

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Hewlett-Packard Company

Notified:  September 25, 2014 Updated:  September 29, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

See the following URL for more information from the vendor.

Vendor References

http://alerts.hp.com/r?2.1.3KT.2ZR.15ee22.L8mgqE..N.ghvS.8f9A.bW89MQ%5f%5fDBOSFQK0

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

IBM Corporation

Notified:  September 25, 2014 Updated:  September 27, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272 http://www-01.ibm.com/support/docview.wss?uid=swg21685433&myns=swgws&mynp=OCSSEQTP&mynp=OCSSEQTJ&mync=E

Addendum

AIX Toolbox for Linux Applications provides Bash and is vulnerable. IBM HTTP Server (IHS) is based on Apache and may act as an attack vector, depending on configuration.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Juniper Networks, Inc.

Notified:  September 25, 2014 Updated:  September 25, 2014

Statement Date:   September 25, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://kb.juniper.net/JSA10648

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Mageia

Updated:  September 27, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://advisories.mageia.org/MGASA-2014-0388.html

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

McAfee

Notified:  September 25, 2014 Updated:  October 07, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://kc.mcafee.com/corporate/index?page=content&id=SB10085

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

NEC Corporation

Notified:  September 25, 2014 Updated:  October 07, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://jpn.nec.com/security-info/av14-003.html

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

NIKSUN

Notified:  November 10, 2014 Updated:  November 11, 2014

Status

  Affected

Vendor Statement

Information contained below is subject to change due to the evolving nature of
CVE-reported information & available fixes.

"ShellShock" CVE-2014-6271 & CVE-2014-7169 are now resolved in software patches
made available via NIKSUN SupportNet. NIKSUN has now produced software updates
for all supported product lines. We continue to observe activity on the NSON
(NIKSUN Security Observation Network) to produce current threat detections –
more signatures may be released as we continuously observe behavior globally.
Current signatures should be downloaded & installed, available via SupportNet,
to get the most out of your NIKSUN security products.

The BASH component defect affecting the community-at-large is serious, but
unlike the Heartbleed defect, which generically affected many publically
available products in exactly the same way, Shellshock requires a specific set
of conditions to exist for exploitation.

NIKSUN is both a contributor to the open source community as well as a consumer
and is leveraging those relationships to bring this issue to a satisfactory
close.

"ShellShock" CVE-2014-6271 & CVE-2014-7169 are now resolved in software patches
made available via NIKSUN SupportNet. NIKSUN has now produced software updates
for all supported product lines, with additional work in progress on breaking
CVEs related to ShellShock exposed in the last few days – software currently
in a quality assurance cycle will become available this week for remaining CVEs
associated with ShellShock now that the global community has agreed on a
sustainable, supportable fix. We continue to observe activity on the NSON
(NIKSUN Security Observation Network) to produce current threat detections with
more signatures released as we continuously observe behavior globally. Current
signatures should be downloaded & installed, available via SupportNet, to get
the most out of your NIKSUN security products.

NIKSUN is committed to providing a rapid resolution to this issue while
ensuring quality, stability & completeness of a fix.

The list below is not a fully comprehensive version list

NIKOS Appliance 4.3.2.0
NIKOS Appliance 4.3.1.2
NIKOS Appliance 4.4.1.1
NIKOS Appliance 4.4.1.2
NIKOS Appliance 4.5.0.0_9
NIKOS Appliance 4.5.0.1

NetOmni 4.3.1.2
NetOmni 4.3.2.0
NetOmni 4.4.1.1
NetOmni 4.4.1.2
NetOmni 4.5.0.0
NetOmni 4.5.0.1
NetOmni 4.5.1.0

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

NetApp

Updated:  September 29, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

See the following URL for more information from the vendor

Vendor References

https://library.netapp.com/ecm/ecm_get_file/ECMP1655016

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Novell, Inc.

Notified:  September 25, 2014 Updated:  September 27, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://support.novell.com/security/cve/CVE-2014-6271.html

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Oracle Corporation

Notified:  September 25, 2014 Updated:  September 29, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://oss.oracle.com/pipermail/el-errata/2014-September/004485.html http://www.oracle.com/technetwork/topics/security/alert-cve-2014-7169-2303276.html

Addendum

Solaris includes Bash and Oracle Linux is based on Red Hat Linux.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Palo Alto Networks

Notified:  September 25, 2014 Updated:  September 29, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://securityadvisories.paloaltonetworks.com/

Addendum

See PAN-SA-2012-000{2,3,4,5}. Please use CVE.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

QNAP Security

Updated:  April 14, 2015

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://www.qnap.com/i/en/news/con_show.php?op=showone&cid=360

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Red Hat, Inc.

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://access.redhat.com/articles/1200223 https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

SUSE Linux

Notified:  September 25, 2014 Updated:  September 29, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://support.novell.com/security/cve/CVE-2014-6271.html https://www.suse.com/support/shellshock/ https://www.suse.com/support/kb/doc.php?id=7015702

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Slackware Linux Inc.

Notified:  September 25, 2014 Updated:  September 25, 2014

Statement Date:   September 25, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.522193

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Sophos, Inc.

Updated:  September 27, 2014

Status

  Affected

Vendor Statement

As far as we are aware, none of Sophos's Linux or UNIX products use Bash in a way that would allow this vulnerability to be exploited with data supplied by an attacker from outside.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www.sophos.com/en-us/support/knowledgebase/121444.aspx http://nakedsecurity.sophos.com/2014/09/25/bash-shellshock-vulnerability-what-you-need-to-know/

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Trend Micro

Updated:  September 27, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://esupport.trendmicro.com/solution/en-US/1105233.aspx

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Ubuntu

Notified:  September 25, 2014 Updated:  September 27, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://www.ubuntu.com/usn/usn-2362-1/

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

VMware

Notified:  September 25, 2014 Updated:  September 27, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2090740

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Xirrus

Updated:  October 01, 2014

Status

  Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://cdn.xirrus.com/pdf/Statement-on-ShellShock.pdf

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

FreeBSD Project

Notified:  September 25, 2014 Updated:  September 26, 2014

Statement Date:   September 25, 2014

Status

  Not Affected

Vendor Statement

Currently we have already patched CVE-2014-6271 and CVE-2014-7169 in the FreeBSD ports tree, making it no longer vulnerable to these two issues. We will patch the new issues once the fix is validated.

The FreeBSD base system do not use bash at all and is therefore not affected.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

https://svnweb.freebsd.org/ports?view=revision&revision=369341

Addendum

FreeBSD has disabled function importing by default in the Bash port.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Global Technology Associates, Inc.

Notified:  September 25, 2014 Updated:  October 01, 2014

Status

  Not Affected

Vendor Statement

GTA firewalls running any version of GB-OS are not vulnerable to the "shellshock" exploit.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Microsoft Corporation

Notified:  September 25, 2014 Updated:  October 10, 2014

Status

  Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

NetBSD

Notified:  September 25, 2014 Updated:  September 26, 2014

Status

  Not Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

http://pkgsrc.se/files.php?messageId=20140925202832.9AD9C98@cvs.netbsd.org

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

ACCESS

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

AT&T

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Alcatel-Lucent

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Belkin, Inc.

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CA Technologies

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Cray Inc.

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

DragonFly BSD Project

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

EMC Corporation

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Engarde Secure Linux

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Enterasys Networks

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Ericsson

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Force10 Networks, Inc.

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Foundry Networks, Inc.

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Fujitsu

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Google

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Hitachi

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

IBM Corporation (zseries)

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

IBM eServer

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Infoblox

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Intel Corporation

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Intoto

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Mandriva S. A.

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

MontaVista Software, Inc.

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Mozilla

Notified:  October 27, 2014 Updated:  October 27, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Nokia

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

OpenBSD

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Openwall GNU/*/Linux

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Peplink

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Q1 Labs

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

QNX Software Systems Inc.

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Quagga

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

SafeNet

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

SmoothWall

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Snort

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Sony Corporation

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Sourcefire

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Spyrus

Notified:  November 19, 2014 Updated:  November 19, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Stonesoft

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Symantec

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

The SCO Group

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

TippingPoint Technologies Inc.

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Turbolinux

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Unisys

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Vyatta

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Watchguard Technologies, Inc.

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Wind River Systems, Inc.

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

ZyXEL

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

eSoft, Inc.

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

m0n0wall

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

netfilter

Notified:  September 25, 2014 Updated:  September 25, 2014

Status

  Unknown

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Addendum

There are no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.


CVSS Metrics

Group Score Vector
Base 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal 9.5 E:H/RL:W/RC:C
Environmental 9.6 CDP:LM/TD:H/CR:ND/IR:ND/AR:ND

References

Credit

This document was written by Chris King.

Other Information

CVE IDs: CVE-2014-6271, CVE-2014-7169, CVE-2014-6277, CVE-2014-7186, CVE-2014-7187
Date Public: 2014-09-24
Date First Published: 2014-09-25
Date Last Updated: 2015-04-14 20:35 UTC
Document Revision: 55

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.