GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability. Đang bị khai thác thực tế: CISA đưa lỗ hổng này vào danh mục Known Exploited Vulnerabilities ngày 28/01/2022. Hãy vá các hệ thống bị ảnh hưởng ngay.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| security gateway | < r77.30 | r77.30 |
| big-ip access policy manager | = 11.6.0≥ 10.1.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.5.1 | |
| big-ip advanced firewall manager | = 11.6.0≥ 11.3.0, ≤ 11.5.1 | |
| big-ip analytics | = 11.6.0≥ 11.0.0, ≤ 11.5.1 | |
| big-ip application acceleration manager | = 11.6.0≥ 11.4.0, ≤ 11.5.1 | |
| big-ip application security manager | = 11.6.0≥ 10.0.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.5.1 | |
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí≥ 10.1.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.3.0 |
| big-ip global traffic manager | = 11.6.0≥ 10.0.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.5.1 |
| big-ip link controller | = 11.6.0≥ 10.0.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.5.1 |
| big-ip local traffic manager | = 11.6.0≥ 10.0.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.5.1 |
| big-ip policy enforcement manager | = 11.6.0≥ 11.3.0, ≤ 11.5.1 |
| big-ip protocol security module | ≥ 10.0.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.4.1 |
| big-ip wan optimization manager | ≥ 10.0.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.3.0 |
| big-ip webaccelerator | ≥ 10.0.0, ≤ 10.2.4≥ 11.0.0, ≤ 11.3.0 |
| big-iq cloud | ≥ 4.0.0, ≤ 4.4.0 |
| big-iq device | ≥ 4.2.0, ≤ 4.4.0 |
| big-iq security | ≥ 4.0.0, ≤ 4.4.0 |
| enterprise manager | ≥ 2.1.0, ≤ 2.3.0≥ 3.0.0, ≤ 3.1.1 |
| traffix signaling delivery controller | = 3.3.2= 3.4.1= 3.5.1= 4.1.0≥ 4.0.0, ≤ 4.0.5 |
| bash | ≤ 4.3 |
| infosphere guardium database activity monitoring | = 8.2= 9.0= 9.1 |
| pureapplication system | = 2.0.0.0≥ 1.0.0.0, ≤ 1.0.0.4≥ 1.1.0.0, ≤ 1.1.0.4 |
| qradar risk manager | = 7.1.0 |
| qradar security information and event manager | = 7.1.0= 7.1.1= 7.1.2= 7.2= 7.2.0= 7.2.1= 7.2.2= 7.2.3= 7.2.4= 7.2.5= 7.2.6= 7.2.7= 7.2.8= 7.2.8.15= 7.2.9 |
| qradar vulnerability manager | = 7.2.0= 7.2.1= 7.2.2= 7.2.3= 7.2.4= 7.2.6= 7.2.8 |
| smartcloud entry appliance | = 2.3.0= 2.4.0= 3.1.0= 3.2.0 |
| smartcloud provisioning | = 2.1.0 |
| software defined network for virtual environments | < 1.2.1 | 1.2.1 |
| starter kit for cloud | = 2.2.0 |
| workload deployer | ≥ 3.1.0, ≤ 3.1.0.7 |
| zenworks configuration management | = 10.3= 11= 11.1= 11.2= 11.3.0 |
| gluster storage server for on-premise | = 2.1 |
| virtualization | = 3.4 |
| studio onsite | = 1.3 |
| vcenter server appliance | = 5.0= 5.1= 5.5 |