Multiple vulnerabilities in HP Remote Device Access: Virtual Customer Access System (vCAS)
| Risk | Critical |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2014-6271 CVE-2014-7169 |
| CWE-ID | CWE-77 |
| Exploitation vector | Network |
| Public exploit |
Vulnerability #1 is being exploited in the wild. Vulnerability #2 is being exploited in the wild. |
| Vulnerable software |
Virtual Customer Access System (vCAS) Other software / Other software solutions |
| Vendor | HPE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Command injection
EUVDB-ID: #VU5295
Risk: Critical
CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]
CVE-ID: CVE-2014-6271
CWE-ID:
CWE-77 - Command injection
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The vulnerability exists due to incorrect parsing of environment variables. A remote attacker can execute arbitrary code on the target system as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.
Successful exploitation may allow an attacker to gain complete control over vulnerable system.
Exploitation example:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
Note: this vulnerability was being actively exploited in the wild.
MitigationInstall update from vendor's website.
Vulnerable software versionsVirtual Customer Access System (vCAS): before 14.10-38402
CPE2.3 External linkshttps://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-c04467807
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
2) Command injection
EUVDB-ID: #VU5294
Risk: Critical
CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]
CVE-ID: CVE-2014-7169
CWE-ID:
CWE-77 - Command injection
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary commands on the target system.
The weakness exists due to an incomplete fix related to malformed function definitions in the values of environment variables. By using multiple attack vectors (DHCP, HTTP, SIP, FTP, and SMTP) involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, a remote attacker can inject and execute arbitrary commands.This vulnerability exists due to incomplete fix for vulnerability #1 (CVE-2014-6271).
Exploitation example:
env X='() { (a)=>\' bash -c "echo date"; cat echo
Successful exploitation may allow an attacker to gain complete control over vulnerable system.
Note: this vulnerability was being actively exploited.
MitigationInstall update from vendor's website.
Vulnerable software versionsVirtual Customer Access System (vCAS): before 14.10-38402
CPE2.3 External linkshttps://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=emr_na-c04467807
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
