IBM SDN VE Shellshock Vulnerability Advisory (CVE-2014-6271 et al.)

Critical Vulnerability Information Vulnerability Overview Disclosure Date: September 2014 Affected Product: IBM SDN VE Vulnerability Name: "Bash Bug" or "Shellshock" and two memory corruption vulnerabilities Vulnerability CVE-ID: - CVE-2014-6271 - CVE-2014-7169 - CVE-2014-7186 - CVE-2014-7187 - CVE-2014-6277 - CVE-2014-6278 Vulnerability Details CVE-2014-6271 - CVSS Base Score: 10.0 - Description: Maliciously crafted environment variables can lead to remote execution of arbitrary commands. - CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2014-7169 - CVSS Base Score: 10.0 - Description: Malformed function definitions can result in remote execution of arbitrary commands. - CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2014-7186 - CVSS Base Score: 4.6 - Description: Out-of-bounds access can lead to local execution of arbitrary code or denial of service. - CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:P/A:P) CVE-2014-7187 - CVSS Base Score: 4.6 - Description: Offset error during processing of control flow constructs can lead to local execution of arbitrary code or denial of service. - CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:P/A:P) CVE-2014-6277 - CVSS Base Score: 10.0 - Description: Parsing function definitions can result in remote execution of arbitrary code. - CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C) CVE-2014-6278 - CVSS Base Score: 10.0 - Description: Processing user scripts can lead to remote execution of arbitrary code. - CVSS Vector: (AV:N/AC:L/Au:N/C:C/I:C/A:C) Affected Products and Versions IBM SDN VE, Unified Controller, OpenFlow Edition: versions 1.2.0 and earlier ... (other affected versions) Solution / Mitigation Upgrade affected IBM SDN VE, Unified Controller, and IBM SDN VE Service Appliances to the latest versions, which are identified as: - VMware version: 1.2.1 or later - KVM version: 1.2.1 or later - OpenFlow version: 1.2.1 or later These versions are available for download via Passport Advantage. Indicators and Remediation Indicators: No known indicators or mitigations Subscription Notification Subscribe to My Notifications to receive important product support alerts. Reference Links Complete CVSS v2 Guide Online Calculator v2

Goal Reached Thanks to every supporter — we hit 100%!

IBM SDN VE Shellshock Vulnerability Advisory (CVE-2014-6271 et al.)