Skip to main content
Apexward Pulse

GNU · Code execution

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

CVE-2014-6271

What this means

This is rated critical severity (9.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Gnu Bash, Arista Eos and Oracle Linux, and 9 more are in your estate, and treat that as the priority.

Full vendor description

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

Scoring and exploitation

9.8/ 10
CVSS 3.1 base scoreCritical

Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeUnchangedS:U

Impact

Longer bar: more harm

ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
Elevated attack likelihood (~100% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
GNU Bourne-Again Shell (Bash)

Weaknesses

CWE-78

Affected products ()

  • Gnu Bash
  • Arista Eos
  • Oracle Linux
  • Qnap Qts
  • Mageia Mageia
  • Redhat Gluster Storage Server for On Premise
  • Redhat Virtualization
  • Redhat Enterprise Linux
  • Redhat Enterprise Linux Desktop
  • Redhat Enterprise Linux Eus
  • Redhat Enterprise Linux for Ibm Z Systems
  • Redhat Enterprise Linux for Power Big Endian
Show the raw CPE strings (40)
  • cpe:2.3:a:gnu:bash:*:*:*:*:*:*:*:*
  • cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*
  • cpe:2.3:o:oracle:linux:4:*:*:*:*:*:*:*
  • cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*
  • cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:4.1.1:-:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:4.1.1:build_0927:*:*:*:*:*:*
  • cpe:2.3:o:mageia:mageia:3.0:*:*:*:*:*:*:*
  • cpe:2.3:o:mageia:mageia:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:virtualization:3.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*

Showing 25 of 40 matches from .

References

20 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events