Avaya Gateways and 16xx/46xx/96x0/B179 Endpoints Response to GNU Bash (shellshock) Vulnerabilities (CVE-2014-6271, CVE-2014-7169)

Original Release Date: October 1, 2014
Last Revised: October 13, 2014
Number: ASA-2014-379
Risk Level: None
Advisory Version: 3.0
Advisory Status: Final

1. Overview:

GNU Bash is a popular open source command line shell incorporated into Linux and other widely used operating systems. Vulnerabilities have been discovered that may allow a remote user to execute arbitrary code on systems that are running affected versions of Bash. These vulnerabilities are also known as shellshock. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277 and CVE-2014-6278 to these issues.

The Shellshock security issue is not applicable to the Avaya G430/G450 gateways, their media modules nor any of the Avaya G650 TN circuit packs. It is also not applicable to any of the 16xx, 46xx, and 96x0 series endpoints. All of these platforms use embedded operating systems that do not support bash.

2. Avaya Gateway, TN Circuit Pack and 16xx/46xx/96x0/B179 Products with affected packages installed: None

3. Additional Information:

Additional information may also be available via the Avaya support website and through your Avaya account representative. Please contact your Avaya product support representative, or dial 1-800-242-2121, with any questions.

4. Disclaimer:

ALL INFORMATION IS BELIEVED TO BE CORRECT AT THE TIME OF PUBLICATION AND IS PROVIDED "AS IS". AVAYA INC., ON BEHALF ITSELF AND ITS SUBSIDIARIES AND AFFILIATES (HEREINAFTER COLLECTIVELY REFERRED TO AS "AVAYA"), DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND FURTHERMORE, AVAYA MAKES NO REPRESENTATIONS OR WARRANTIES THAT THE STEPS RECOMMENDED WILL ELIMINATE SECURITY OR VIRUS THREATS TO CUSTOMERS' SYSTEMS. IN NO EVENT SHALL AVAYA BE LIABLE FOR ANY DAMAGES WHATSOEVER ARISING OUT OF OR IN CONNECTION WITH THE INFORMATION OR RECOMMENDED ACTIONS PROVIDED HEREIN, INCLUDING DIRECT, INDIRECT, INCIDENTAL, STATUTORY, CONSEQUENTIAL DAMAGES, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF AVAYA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

THE INFORMATION PROVIDED HERE DOES NOT AFFECT THE SUPPORT AGREEMENTS IN PLACE FOR AVAYA PRODUCTS. SUPPORT FOR AVAYA PRODUCTS CONTINUES TO BE EXECUTED AS PER EXISTING AGREEMENTS WITH AVAYA.

5. Revision History:

V 1.0 - October 1, 2014 - Initial Statement issued.
V 2.0 - October 8, 2014 - Updated to include 16xx/46xx/96x0 series endpoints.
V 3.0 - October 13, 2014 - Updated to include B179.

Avaya customers or Business Partners should report any security issues found with Avaya products via the standard support process.
Independent security researchers can contact Avaya at securityalerts@avaya.com.

© 2014 Avaya Inc. All Rights Reserved. All trademarks identifying Avaya products by the ® or ™ are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners.