CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2016-0634 – bash: Arbitrary code execution via malicious hostname
https://notcve.org/view.php?id=CVE-2016-0634
The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine. La expansión de \h en la línea de comandos en bash 4.3 permite a los usuarios autenticados remotos ejecutar código arbitrario mediante metacaracteres shell ubicados en 'hostname' de la máquina. An arbitrary command injection flaw was found in the way bash processed the hostname value. A malicious DHCP server could use this flaw to execute arbitrary commands on the DHCP client machines running bash under specific circumstances. • http://rhn.redhat.com/errata/RHSA-2017-0725.html http://www.openwall.com/lists/oss-security/2016/09/16/12 http://www.openwall.com/lists/oss-security/2016/09/16/8 http://www.openwall.com/lists/oss-security/2016/09/18/11 http://www.openwall.com/lists/oss-security/2016/09/19/7 http://www.openwall.com/lists/oss-security/2016/09/20/1 http://www.openwall.com/lists/oss-security/2016/09/27/9 http://www.openwall.com/lists/oss-security/2016/09/29& • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 97%CPEs: 28EXPL: 5CVE-2014-6278 – Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 - Command Injection (Shellshock)
https://notcve.org/view.php?id=CVE-2014-6278
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277. GNU Bash hasta 4.3 bash43-026 no analiza debidamente las definiciones de funciones en los valores de las variables de entornos, lo que permite a atacantes remotos ejecutar comandos arbitrarios a través de un entorno manipulado, como fue demostrado por vectores involucrando la caracteristica ForceCommand en OpenSSH sshd, los módulos mod_cgi y mod_cgid en el servidor Apache HTTP, secuencias de comandos ejecutadas por clientes DHCP no especificados, y otras situaciones en las cuales la configuración del entorno ocurre tras un límite de privilegios de la ejecución de Bash. NOTA: esta vulnerabilidad existe debido a una solución incompleta para el CVE-2014-6271, CVE-2014-7169, y CVE-2014-6277. DNS reverse lookups can be used as a vector of attack for the bash shellshock vulnerability. • https://www.exploit-db.com/exploits/39887 https://www.exploit-db.com/exploits/39568 https://www.exploit-db.com/exploits/34900 https://www.exploit-db.com/exploits/36933 https://www.exploit-db.com/exploits/34860 http://jvn.jp/en/jp/JVN55667175/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126 http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html http://linux.or • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 97%CPEs: 28EXPL: 4CVE-2014-6277 – Binary File Descriptor Library (libbfd) - Out-of-Bounds Crash
https://notcve.org/view.php?id=CVE-2014-6277
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169. GNU Bash hasta 4.3 bash43-026 no analiza debidamente las definiciones de funciones en los valores de las variables de entornos, lo que permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (acceso a memoria no inicializada, y operaciones de leer y escribir de puntero no confiables) a través de un entorno manipulado, como fue demostrado por vectores que involucran la característica ForceCommand en OpenSSH sshd, los módulos mod_cgi y mod_cgid en el servidor de Apache HTTP , secuencias de comandos ejecutados por clientes DHCP no especificados, y otras situaciones en que la configuración del entorno ocurre cruzando un límite de privilegios de la ejecución de Bash. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2014-6271 y CVE-2014-7169. DNS reverse lookups can be used as a vector of attack for the bash shellshock vulnerability. • https://www.exploit-db.com/exploits/35081 https://www.exploit-db.com/exploits/36933 https://www.exploit-db.com/exploits/34860 http://jvn.jp/en/jp/JVN55667175/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126 http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html http://linux.oracle.com/errata/ELSA-2014-3093 http://linux.oracle.com/errata/ELSA-2014-3094 http:/&# • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 97%CPEs: 28EXPL: 3CVE-2014-7186 – dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)
https://notcve.org/view.php?id=CVE-2014-7186
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue. La implementación de redirección en parse.y en GNU Bash hasta 4.3 bash43-026 permite a atacantes remotos causar una denegación de servicio (acceso a array fuera de rango y caída de la aplicación) o posiblemente tener otro impacto no especificado a través de el uso manipulado de documentos here, también conocido como el problema 'redir_stack'. It was discovered that the fixed-sized redir_stack could be forced to overflow in the Bash parser, resulting in memory corruption, and possibly leading to arbitrary code execution when evaluating untrusted input that would not otherwise be run as code. DNS reverse lookups can be used as a vector of attack for the bash shellshock vulnerability. • https://www.exploit-db.com/exploits/36933 https://www.exploit-db.com/exploits/34860 http://jvn.jp/en/jp/JVN55667175/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126 http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00041.html http://lists. • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 97%CPEs: 28EXPL: 3CVE-2014-7187 – dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)
https://notcve.org/view.php?id=CVE-2014-7187
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue. Error de superación de límite (off-by-one) en la función read_token_word en parse.y en GNU Bash hasta 4.3 bash43-026 permite a atacantes remotos causar una denegación de servicio (acceso a array fuera de rango y caída de la aplicación) o posiblemente tener otro impacto no especificado a través de profundamente anidados para bucles, también conocido como el problema 'word_lineno'. An off-by-one error was discovered in the way Bash was handling deeply nested flow control constructs. Depending on the layout of the .bss segment, this could allow arbitrary execution of code that would not otherwise be executed by Bash. DNS reverse lookups can be used as a vector of attack for the bash shellshock vulnerability. • https://www.exploit-db.com/exploits/36933 https://www.exploit-db.com/exploits/34860 http://jvn.jp/en/jp/JVN55667175/index.html http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126 http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.html http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00038.html http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00041.html http://lists. • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-193: Off-by-one Error •