GNU Bash off-by-one Error Arbitrary Code Execution Vulnerability

Publish date: July 21, 2015
  Severity: CRITICAL
  CVE Identifier: CVE-2014-7187
  Advisory Date: SEP 28, 2014

  DESCRIPTION

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

  TREND MICRO PROTECTION INFORMATION

Apply associated Trend Micro DPI Rules.

  SOLUTION

  Trend Micro Deep Security DPI Rule Number: 1006261
  Trend Micro Deep Security DPI Rule Name: 1006261 - Identified Suspicious Bash ShellShock Attack

  AFFECTED SOFTWARE AND VERSION

  • gnu bash 1.14.0
  • gnu bash 1.14.1
  • gnu bash 1.14.2
  • gnu bash 1.14.3
  • gnu bash 1.14.4
  • gnu bash 1.14.5
  • gnu bash 1.14.6
  • gnu bash 1.14.7
  • gnu bash 2.0
  • gnu bash 2.01
  • gnu bash 2.01.1
  • gnu bash 2.02
  • gnu bash 2.02.1
  • gnu bash 2.03
  • gnu bash 2.04
  • gnu bash 2.05
  • gnu bash 3.0
  • gnu bash 3.0.16
  • gnu bash 3.1
  • gnu bash 3.2
  • gnu bash 3.2.48
  • gnu bash 4.0
  • gnu bash 4.1
  • gnu bash 4.2
  • gnu bash 4.3

  OTHER INFORMATION

Shellshock
Shellshock: A Technical Report
About the Shellshock Vulnerability: The Basics of the "Bash Bug"
Trend Micro products and the Shellshock – Linux Bash Vulnerability (Bash Bug) [CVE-2014-6271 and CVE-2014-7169]
Get FREE protection for Shellshock

Featured Stories