Detections
Analytics

FreeBSD : bash -- remote code execution vulnerability (71ad81da-4414-11e4-a33e-3c970e169bc2) (Shellshock)

critical Nessus Plugin ID 77836

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

Chet Ramey reports :

Under certain circumstances, bash will execute user code while processing the environment for exported function definitions.

The original fix released for CVE-2014-6271 was not adequate. A similar vulnerability was discovered and tagged as CVE-2014-7169.

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?dacf7829

https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00081.html

https://seclists.org/oss-sec/2014/q3/690

http://www.nessus.org/u?1ec4245a

Plugin Details

Severity: Critical

ID: 77836

File Name: freebsd_pkg_71ad81da441411e4a33e3c970e169bc2.nasl

Version: 1.21

Type: local

Published: 9/25/2014

Updated: 12/5/2022

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.5

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:linux_base-c6, p-cpe:/a:freebsd:freebsd:bash-static, cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:bash

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/24/2014

Vulnerability Publication Date: 9/24/2014

CISA Known Exploited Vulnerability Due Dates: 7/28/2022

Exploitable With

Core Impact

Metasploit (Qmail SMTP Bash Environment Variable Injection (Shellshock))

Reference Information

CVE: CVE-2014-6271, CVE-2014-7169

IAVA: 2014-A-0142