-----BEGIN PGP SIGNED MESSAGE-----
AUSCERT External Security Bulletin Redistribution
ZENworks Configuration Management vulnerability with GNU
Bash Remote Code Execution (aka ShellShock)
7 October 2014
AusCERT Security Bulletin Summary
Product: Novell ZENworks Configuration Management
Operating System: Windows
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Modify Arbitrary Files -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
CVE Names: CVE-2014-7187 CVE-2014-7186 CVE-2014-7169
CVE-2014-6278 CVE-2014-6277 CVE-2014-6271
- --------------------------BEGIN INCLUDED TEXT--------------------
ZENworks Configuration Management vulnerability with GNU Bash Remote Code
Execution (aka ShellShock)
This document (7015721) is provided subject to the disclaimer at the end of
Novell ZENworks Configuration Management 11.3
Novell ZENworks Configuration Management 11.2
Novell ZENworks Configuration Management 11.1
Novell ZENworks Configuration Management 11
Novell ZENworks Configuration Management 10.3
Shellshock, also known as Bashdoor, is a security vulnerability in the widely
used Linux/Unix Bash shell. Novell ZENworks Configuration Management is
affected by this security vulnerability. For more details on this, please
Further information regarding these security issues can be found here:
For ZENworks Configuration Management running on SLES operating system, please
refer to TID 7015702, which provides specific instructions on how to apply the
patch to the Operating System to address this issue.
For ZENworks Virtual Appliance, please use the information provided in this
document in order to overcome this vulnerability.
The patch and instructions can be downloaded from download.novell.com under
ZENworks Configuration Management product section, or directly by clicking on
this link. This patch applies only to ZEN Virtual Appliance.
On the other hand, this patch will also be automatically included in any
future update for ZCM Appliance.
This Support Knowledgebase provides a valuable tool for NetIQ/Novell/SUSE
customers and parties interested in our products and solutions to acquire
information, ideas and learn from one another. Materials are provided for
informational, personal or non-commercial use within your organization and are
presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to firstname.lastname@example.org
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
Australian Computer Emergency Response Team
The University of Queensland
Internet Email: email@example.com
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----