a. Bash update for multiple products.

   Bash libraries have been updated in multiple products to resolve    multiple critical security issues, also referred to as Shellshock.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the identifiers CVE-2014-6271, CVE-2014-7169,    CVE-2014-7186, and CVE-2014-7187, CVE-2014-6277, CVE-2014-6278    to these issues.

   VMware products have been grouped into the following four    product categories :
      I) ESXi and ESX Hypervisor    ESXi is not affected because ESXi uses the Ash shell (through    busybox), which is not affected by the vulnerability reported    for the Bash shell.
   ESX has an affected version of the Bash shell. See table 1 for    remediation for ESX.
    II) Windows-based products    Windows-based products, including all versions of vCenter Server    running on Windows, are not affected.

   III) VMware (virtual) appliances    VMware (virtual) appliances ship with an affected version of Bash.    See table 2 for remediation for appliances.
      IV) Products that run on Linux, Android, OSX or iOS (excluding    virtual appliances)

   Products that run on Linux, Android, OSX or iOS (excluding    virtual appliances) might use the Bash shell that is part of the    operating system. If the operating system has a vulnerable    version of Bash, the Bash security vulnerability might be    exploited through the product. VMware recommends that customers    contact their operating system vendor for a patch.          MITIGATIONS

   VMware encourages restricting access to appliances through    firewall rules and other network layer controls to only trusted IP    addresses. This measure will greatly reduce any risk to these    appliances.

   RECOMMENDATIONS

   VMware recommends customers evaluate and deploy patches for    affected products in Table 1 and 2 below as these    patches become available. 

   For several products, both a patch and a product update are available.
   In general, if a patch is  made available, the patch must be applied    to the latest version of the appliance.

   Customers should refer to the specific product Knowledge Base articles    listed in Section 4 to understand the type of remediation available and    applicable appliance version numbers.

   Column 4 of the following tables lists the action required to    remediate the vulnerability in each release, if a solution is    available.

   Table 1 - ESXi and ESX Hypervisor    =================================

Detections

Analytics

VMSA-2014-0010 : VMware product updates address critical Bash security vulnerabilities (Shellshock)

critical Nessus Plugin ID 78025

Version 1.40

Version 1.39

Version 1.38

Version 1.40 Oct 3, 2025, 10:49 PM CISA reference Plugin Feed: 202510032249
Version 1.39 Oct 3, 2025, 2:02 AM CVSSv3 score source (set to "CVE-2014-7169") CVSSv2 score source (set to "CVE-2014-7187") CISA reference Plugin Feed: 202510030202
Version 1.38 Dec 6, 2022, 4:40 AM Reference Plugin Feed: 202212060440