Skip to main content
Apexward Pulse

GNU · Code execution

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

CVE-2014-7169

What this means

This is rated critical severity (9.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Gnu Bash, Arista Eos and Oracle Linux, and 9 more are in your estate, and treat that as the priority.

Full vendor description

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

Scoring and exploitation

9.8/ 10
CVSS 3.1 base scoreCritical

Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeUnchangedS:U

Impact

Longer bar: more harm

ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
Elevated attack likelihood (~99.9% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
GNU Bourne-Again Shell (Bash)

Weaknesses

CWE-78

Affected products ()

  • Gnu Bash
  • Arista Eos
  • Oracle Linux
  • Qnap Qts
  • Mageia Mageia
  • Redhat Gluster Storage Server for On Premise
  • Redhat Virtualization
  • Redhat Enterprise Linux
  • Redhat Enterprise Linux Desktop
  • Redhat Enterprise Linux Eus
  • Redhat Enterprise Linux for Ibm Z Systems
  • Redhat Enterprise Linux for Power Big Endian
Show the raw CPE strings (40)
  • cpe:2.3:a:gnu:bash:*:*:*:*:*:*:*:*
  • cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:*
  • cpe:2.3:o:oracle:linux:4:*:*:*:*:*:*:*
  • cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*
  • cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:4.1.1:-:*:*:*:*:*:*
  • cpe:2.3:o:qnap:qts:4.1.1:build_0927:*:*:*:*:*:*
  • cpe:2.3:o:mageia:mageia:3.0:*:*:*:*:*:*:*
  • cpe:2.3:o:mageia:mageia:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:virtualization:3.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*

Showing 25 of 40 matches from .

References

20 links from the CVE record, grouped by site.

Related feed events