| Summary: | On September 24, 2014, a vulnerability in the Bash shell was; publicly announced. The vulnerability is related to the way in which shell functions are passed; though environment variables. The vulnerability may allow an attacker to inject commands into a; Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of; processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers. |
| Description: | Summary:
On September 24, 2014, a vulnerability in the Bash shell was
publicly announced. The vulnerability is related to the way in which shell functions are passed
though environment variables. The vulnerability may allow an attacker to inject commands into a
Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of
processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers.
Vulnerability Insight:
All versions of GNU Bash starting with version 1.14 are
affected by this vulnerability and the specific impact is determined by the characteristics of
the process using the Bash shell. In the worst case, an unauthenticated remote attacker would be
able to execute commands on an affected server. However, in most cases involving Cisco products,
authentication is required before exploitation could be attempted.
Solution:
See the referenced vendor advisory for a solution.
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
