topic Security Advisory: Intel(R) MPSS affected by Shellshock bug in Software Archive https://community.intel.com/t5/Software-Archive/Security-Advisory-Intel-R-MPSS-affected-by-Shellshock-bug/m-p/1024805#M39688 <P>&nbsp;</P> <P>Recently there was a critical vulnerability exposed in the GNU* Bourne-Again Shell (Bash), the common command-line shell used in many Linux*/UNIX operating system. &nbsp; This vulnerability also affects the operating system used for the Intel(R) Xeon Phi(tm) Coprocessor. &nbsp;</P> <P>Several Intel(R) MPSS Hotfixes will be released that address all six of the known CVEs related to the newly-discovered Bash vulnerabilities (CVE-2014-6721, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, and CVE-2014-6728) and corresponds to patch level 052 of the Bash ver. 4.2 as published by GNU.org&nbsp;</P> <P>Intel(R) MPSS 3.1-x, 3.2-x, 3.3-x and 3.4-x are all affected, as well as previous MPSS 2.x releases.</P> <P>No patches will be released for obsolete releases (MPSS 2.x). &nbsp; As a workaround, it is possible to re/cross-compile a bash from patched sources.</P> <P>Patches for MPSS 3.3 (Linux) were recently released (see <A href="https://software.intel.com/en-us/articles/intel-manycore-platform-software-stack-mpss&nbsp;)" target="_blank">https://software.intel.com/en-us/articles/intel-manycore-platform-software-stack-mpss&nbsp;)</A></P> <P>Patches for MPSS 3.3 (Windows), 3.4, 3.1 and 3.2 will follow soon. &nbsp;We will update this forum thread when they are available.</P> <P>Customers can verify the vulnerability mitigation by running checkers on the Xeon Phi Coprocessor OS, such as Bashcheck, <A href="https://github.com/hannob/bashcheck" target="_blank">https://github.com/hannob/bashcheck</A>, or another relevant shell-script-based checker of their choice.</P> <P>Please let us know if you have any questions!</P> <P>&nbsp;</P> Wed, 15 Oct 2014 17:15:28 GMT BelindaLiviero 2014-10-15T17:15:28Z Security Advisory: Intel(R) MPSS affected by Shellshock bug https://community.intel.com/t5/Software-Archive/Security-Advisory-Intel-R-MPSS-affected-by-Shellshock-bug/m-p/1024805#M39688 <P>&nbsp;</P> <P>Recently there was a critical vulnerability exposed in the GNU* Bourne-Again Shell (Bash), the common command-line shell used in many Linux*/UNIX operating system. &nbsp; This vulnerability also affects the operating system used for the Intel(R) Xeon Phi(tm) Coprocessor. &nbsp;</P> <P>Several Intel(R) MPSS Hotfixes will be released that address all six of the known CVEs related to the newly-discovered Bash vulnerabilities (CVE-2014-6721, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, and CVE-2014-6728) and corresponds to patch level 052 of the Bash ver. 4.2 as published by GNU.org&nbsp;</P> <P>Intel(R) MPSS 3.1-x, 3.2-x, 3.3-x and 3.4-x are all affected, as well as previous MPSS 2.x releases.</P> <P>No patches will be released for obsolete releases (MPSS 2.x). &nbsp; As a workaround, it is possible to re/cross-compile a bash from patched sources.</P> <P>Patches for MPSS 3.3 (Linux) were recently released (see <A href="https://software.intel.com/en-us/articles/intel-manycore-platform-software-stack-mpss&nbsp;)" target="_blank">https://software.intel.com/en-us/articles/intel-manycore-platform-software-stack-mpss&nbsp;)</A></P> <P>Patches for MPSS 3.3 (Windows), 3.4, 3.1 and 3.2 will follow soon. &nbsp;We will update this forum thread when they are available.</P> <P>Customers can verify the vulnerability mitigation by running checkers on the Xeon Phi Coprocessor OS, such as Bashcheck, <A href="https://github.com/hannob/bashcheck" target="_blank">https://github.com/hannob/bashcheck</A>, or another relevant shell-script-based checker of their choice.</P> <P>Please let us know if you have any questions!</P> <P>&nbsp;</P> Wed, 15 Oct 2014 17:15:28 GMT https://community.intel.com/t5/Software-Archive/Security-Advisory-Intel-R-MPSS-affected-by-Shellshock-bug/m-p/1024805#M39688 BelindaLiviero 2014-10-15T17:15:28Z Patches for MPSS 3.3 (Windows https://community.intel.com/t5/Software-Archive/Security-Advisory-Intel-R-MPSS-affected-by-Shellshock-bug/m-p/1024806#M39689 <P>Patches for MPSS 3.3 (Windows) have been posted - see&nbsp;https://software.intel.com/en-us/articles/intel-manycore-platform-software-stack-mpss</P> <P>&nbsp;</P> Fri, 17 Oct 2014 17:33:06 GMT https://community.intel.com/t5/Software-Archive/Security-Advisory-Intel-R-MPSS-affected-by-Shellshock-bug/m-p/1024806#M39689 BelindaLiviero 2014-10-17T17:33:06Z Patches for MPSS 3.4 are now https://community.intel.com/t5/Software-Archive/Security-Advisory-Intel-R-MPSS-affected-by-Shellshock-bug/m-p/1024807#M39690 <P>Patches for MPSS 3.4 are now posted</P> Wed, 22 Oct 2014 22:14:13 GMT https://community.intel.com/t5/Software-Archive/Security-Advisory-Intel-R-MPSS-affected-by-Shellshock-bug/m-p/1024807#M39690 BelindaLiviero 2014-10-22T22:14:13Z Patches for the older 3.1.x https://community.intel.com/t5/Software-Archive/Security-Advisory-Intel-R-MPSS-affected-by-Shellshock-bug/m-p/1024808#M39691 <P>Patches for the older 3.1.x and 3.2.x releases are posted on the MPSS Archive page at&nbsp;</P> <P><SPAN style="font-size: 1em; line-height: 1.5;">&nbsp;</SPAN><A href="https://software.intel.com/en-us/articles/intel-manycore-platform-software-stack-mpss-archive" style="font-size: 1em; line-height: 1.5;">https://software.intel.com/en-us/articles/intel-manycore-platform-software-stack-mpss-archive#</A><SPAN style="font-size: 1em; line-height: 1.5;">)</SPAN></P> <P>the versions to get are 3.1.7 and 3.2.5</P> <P>&nbsp;</P> Thu, 06 Nov 2014 00:54:00 GMT https://community.intel.com/t5/Software-Archive/Security-Advisory-Intel-R-MPSS-affected-by-Shellshock-bug/m-p/1024808#M39691 BelindaLiviero 2014-11-06T00:54:00Z