Lucene search

K
ibmIBME9875BEF8E97815B76ED1D0FD7D59E5669EDACF80D617A93E84594F2257B2901
HistoryJun 17, 2018 - 10:32 p.m.

Security Bulletin: Vulnerabilities in Bash affect IBM Worklight Quality Assurance (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

2018-06-1722:32:47
www.ibm.com
20

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

Summary

Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as “Bash Bug” or “Shellshock” and two memory corruption vulnerabilities affecting IBM Worklight Quality Assurance (WQA).

Vulnerability Details

| Subscribe to My Notifications to be notified of important product support alerts like this.

  • Follow this link for more information (requires login with your IBM ID)
    —|—

CVE-ID: CVE-2014-6271

Description: GNU Bash could allow a remote attacker to execute arbitrary commands on the system, caused by an error when evaluating specially-crafted environment variables passed to it by the bash functionality. An attacker could exploit this vulnerability to write to files and execute arbitrary commands on the system.

CVSS Base Score: 10.0
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/96153&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE-ID: CVE-2014-7169

Description: GNU Bash could allow a remote attacker to execute arbitrary commands on the system, caused by an incomplete fix related to malformed function definitions in the values of environment variables. An attacker could exploit this vulnerability using attack vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server to write to files and execute arbitrary commands on the system.

CVSS Base Score: 10.0
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/96209&gt;_ for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE-ID: CVE-2014-7186

Description: GNU Bash could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds memory access while handling redir_stack. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service.

CVSS Base Score: 10
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/96237&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE-ID: CVE-2014-7187

Description: GNU Bash could allow a remote attacker to execute arbitrary code on the system, caused by an off-by-one-error when handling deeply nested flow control constructs. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service.

CVSS Base Score: 10
CVSS Temporal Score: See _<https://exchange.xforce.ibmcloud.com/vulnerabilities/96238&gt;_ for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE-ID:_ _CVE-2014-6277

Description: GNU Bash could allow a remote attacker to execute arbitrary code on the system, caused by an incomplete fix related to the failure to properly parse function definitions in the values of environment variables. An attacker could exploit this vulnerability using attack vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server to execute arbitrary code on the system or cause a denial of service.

CVSS Base Score: 10.0
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/96686&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

CVE-ID:_ _CVE-2014-6278

Description: GNU Bash could allow a remote attacker to execute arbitrary code on the system, caused by an incomplete fix related to the parsing of user scripts. An attacker could exploit this vulnerability to execute arbitrary code on the system or cause a denial of service.

CVSS Base Score: 10.0
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/96687&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C)

Affected Products and Versions

IBM Worklight Quality Assurance 6.0

Remediation/Fixes

Install latest WQA fixpack using IBM Installation Manager or download and install IBM Worklight Quality Assurance Fix Pack 1 (6.0.0.1) for 6.0.

Workarounds and Mitigations

None

CPENameOperatorVersion
ibm mobilefirst quality assuranceeq6.0

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

Related for E9875BEF8E97815B76ED1D0FD7D59E5669EDACF80D617A93E84594F2257B2901