Another Major Vulnerability Bashes Systems
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2014-6271 | Arbitrary Code Execution in GNU Bash (Shellshock) GNU Bash through version 4.3 improperly processes trailing strings that follow function definitions inside environment variable values, allowing injected commands to run (CWE-78, OS command injection); this flaw is widely known as 'Shellshock'. An attacker triggers it by supplying a crafted environment variable to any service that invokes Bash, most notably CGI web handlers but also SSH, DHCP clients, and other software that sets variables and spawns the shell. Successful exploitation yields arbitrary code execution with the privileges of the Bash process on the target host. Any Linux, Unix, or similar system running an unpatched Bash through 4.3 is affected, including web servers, appliances, and embedded devices that ship the shell. Exploitation is confirmed in the wild: the flaw is in CISA's KEV (added 2022-01-28) with a required action to apply vendor updates, and EPSS assigns it a 100% probability of exploitation within 30 days, so patching is urgent. Do: Apply Bash updates per your OS vendor's instructions, as required by the CISA KEV listing, ensuring the installed shell is a patched build newer than the unpatched 4.3-era code. Prioritize internet-exposed systems that pass environment variables to Bash, especially CGI-based web servers, and audit embedded appliances and other Linux/Unix hosts that may have been missed by standard patching. | — | 100% | KEV |
| masshundreds of millions of installations, with hundreds of thousands to 1M+ internet-exposed systems |
Full article434 words · extracted from blog.talosintelligence.com · click to collapse
Thursday, September 25, 2014 04:55
Vulnerabilities that permit remote network attacks against ubiquitous software components are the nightmares of security professionals. On 24 September the presence of a new vulnerability, CVE-2014-6271 in Bash shell allowing remote code execution was disclosed.
The Bash shell is commonly included in many Linux distributions to allow remote users to interact with the system after logging in. As part of its functionality, Bash allows for environment variables that are commonly used to hold values describing the set-up of the shell for easy access by a user or software. Bash also contains limited programming functionality allowing the creation of functions that can be called to execute instructions. The vulnerability occurs during the initiation of a Bash shell for a user, when the environment variables are first read. If the environment variables contain functions then the code contained within the function will be executed. The danger is that in some circumstances the Bash shell environment variables may be set across a privilege boundary allowing a system or user with low privileges to execute arbitrary code.
The vulnerability affects Bash versions up to, and including 4.3. This affects many implementations of Linux, and may also concern electronic devices that include Bash to provide scripting functionality.
Redhat has provided proof of concept code that can be used to check if a system is vulnerable. After logging in to a Bash shell, enter:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
A vulnerable system will display:
vulnerablethis is a test
A Metasploit module is available to test for the vulnerability. Although this provides network teams with the means to check if systems are vulnerable, potentially it also provides attackers with the resources to discover and exploit vulnerable systems first.
We have observed exploitation of the vulnerability in the wild. We have indications that at least some of this activity is due to an automated malicious attack seeking to install DDoS tools on affected systems. However due to the nature of this vulnerability almost any tool or malware sample can be downloaded and executed.
Protecting Users Against These Threats
The best way to block this threat is using Network AMP or Network Security protection of IPS and NGFW. They have up-to-date signatures and will block this threat. The following signatures cover this threat:
Sourcefire: 31975-31978,31985
Cisco: 4689-0, 4689-1, 4689-2, 4689-3
The Cisco Product Security Incident Response Team (PSIRT) is currently investigating if any Cisco products are affected by this vulnerability. For the latest information, please see the Cisco Event Response: GNU Bash Environment Variable Command Injection Vulnerability.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/another-major-vulnerability-bashes/