FYI…
Oracle - Security Alert CVE-2014-7169 released
- https://blogs.oracle.com/security/entry/security_alert_cve_2014_7169
Sep 26, 2014 - "Oracle just released Security Alert CVE-2014-7169*. Vulnerability CVE-2014-7169, previously known as CVE-2014-6271, affects GNU Bash, and if successfully exploited can result in providing a malicious attacker the ability to fully compromise a targeted system… Today’s Security Alert lists the products that Oracle has currently determined to be vulnerable to CVE-2014-7169. Download and installation instructions are provided for those products with available patches. Note that the fixes provided with this Security Alert address both vulnerabilities CVE-2014-7169 and CVE-2014-6271. The Security Alert Advisory will be updated to reflect the availability of fixes for additional products when they have successfully completed testing…"
* http://www.oracle.com/technetwork/topics/security/alert-cve-2014-7169-2303276.html
2014-Sep-30 - Rev. 5 - Added additional CVEs to Solaris and Linux matrices
CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187
- http://www.oracle.com/technetwork/topics/security/alert-cve-2014-7169-2303276.html#PIN
"Oracle has determined that following Oracle products are vulnerable to CVE-2014-7169 and CVE-2014-6271. Fixes for these products will be distributed as they become available and this Security Alert will be updated to reflect the availability of these fixes…"
2014-Sep-30 - Rev 5. Added additional CVEs to Solaris and Linux matrices
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271 - 10.0 (HIGH)
Last revised: 10/10/2014
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169 - 10.0 (HIGH)
Last revised: 10/10/2014
* http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html
"… list of affected products and mitigation instructions as of October 20, 2014 at 06:38 PM Pacific...."
> https://linux.oracle.com/pls/apex/f?p=105:21:3597568493916265
Last entry: 2014-10-20
- http://www.oracle.com/technetwork/topics/security/alert-cve-2014-7169-verbose-2303278.html#SUNS
Advisory (ICSA-14-269-01)
Bash Command Injection Vulnerability
- https://ics-cert.us-cert.gov//advisories/ICSA-14-269-01
Last revised: Oct 03, 2014
