CVEvulnerability
CVE-2014-7169
CISA Known Exploited Vulnerability
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability — GNU Bourne-Again Shell (Bash)
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.
- Added to KEV
- 2022-01-28
- Remediation due
- 2022-07-28
- Ransomware use
- Unknown
- Required action
- Apply updates per vendor instructions.
- Notes
- https://nvd.nist.gov/vuln/detail/CVE-2014-7169
- Status
- Analyzed
- Published
- 2014-09-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-78
Description
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
Affected configurations
• gnu bash (<= 4.3)
• arista eos (>= 4.9.0 < 4.9.12)
• arista eos (>= 4.10.0 < 4.10.9)
• arista eos (>= 4.11.0 < 4.11.11)
• arista eos (>= 4.12.0 < 4.12.9)
• arista eos (>= 4.13.0 < 4.13.9)
• arista eos (>= 4.14.0 < 4.14.4f)
• oracle linux 4
• oracle linux 5
• oracle linux 6
• qnap qts (< 4.1.1)
• qnap qts 4.1.1
• mageia mageia 3.0
• mageia mageia 4.0
• redhat gluster storage server for on-premise 2.1
• redhat virtualization 3.4
• redhat enterprise linux 4.0
• redhat enterprise linux 5.0
• redhat enterprise linux 6.0
• redhat enterprise linux 7.0
• redhat enterprise linux desktop 5.0
• redhat enterprise linux desktop 6.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux eus 5.9
• redhat enterprise linux eus 6.4
• redhat enterprise linux eus 6.5
• redhat enterprise linux eus 7.3
• redhat enterprise linux eus 7.4
• redhat enterprise linux eus 7.5
• redhat enterprise linux eus 7.6
• redhat enterprise linux eus 7.7
• redhat enterprise linux for ibm z systems 5.9 s390x
• redhat enterprise linux for ibm z systems 6.4 s390x
• redhat enterprise linux for ibm z systems 6.5 s390x
• redhat enterprise linux for ibm z systems 7.3 s390x
• redhat enterprise linux for ibm z systems 7.4 s390x
• redhat enterprise linux for ibm z systems 7.5 s390x
• redhat enterprise linux for ibm z systems 7.6 s390x
• redhat enterprise linux for ibm z systems 7.7 s390x
• redhat enterprise linux for power big endian 5.0 ppc
• redhat enterprise linux for power big endian 5.9 ppc
• redhat enterprise linux for power big endian 6.0 ppc64
• redhat enterprise linux for power big endian 6.4 ppc64
• redhat enterprise linux for power big endian 7.0 ppc64
• redhat enterprise linux for power big endian eus 6.5 ppc64
• redhat enterprise linux for power big endian eus 7.3 ppc64
• redhat enterprise linux for power big endian eus 7.4 ppc64
• redhat enterprise linux for power big endian eus 7.5 ppc64
• redhat enterprise linux for power big endian eus 7.6 ppc64
• redhat enterprise linux for power big endian eus 7.7 ppc64
• redhat enterprise linux for scientific computing 6.0
• redhat enterprise linux for scientific computing 7.0
• redhat enterprise linux server 5.0
• redhat enterprise linux server 6.0
• redhat enterprise linux server 7.0
• redhat enterprise linux server aus 5.6
• redhat enterprise linux server aus 5.9
• redhat enterprise linux server aus 6.2
• redhat enterprise linux server aus 6.4
• redhat enterprise linux server aus 6.5
… and 168 more
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- http://advisories.mageia.org/MGASA-2014-0393.html Third Party Advisory
- http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html Broken Link
- http://jvn.jp/en/jp/JVN55667175/index.html Third Party Advisory
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126 Third Party Advisory, VDB Entry
- http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html Third Party Advisory
- http://linux.oracle.com/errata/ELSA-2014-1306.html Third Party Advisory
- http://linux.oracle.com/errata/ELSA-2014-3075.html Third Party Advisory
- http://linux.oracle.com/errata/ELSA-2014-3077.html Third Party Advisory
- http://linux.oracle.com/errata/ELSA-2014-3078.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00038.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00041.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00042.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00044.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00048.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00004.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2014-10/msg00023.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.html Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=141216207813411&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141216668515282&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141235957116749&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141319209015420&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141330425327438&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141330468527613&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141345648114150&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141383026420882&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141383081521087&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141383138121313&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141383196021590&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141383244821813&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141383304022067&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141383353622268&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141383465822787&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141450491804793&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141576728022234&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141577137423233&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141577241923505&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141577297623641&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141585637922673&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141694386919794&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=141879528318582&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=142113462216480&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=142118135300698&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=142358026505815&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=142358078406056&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=142721162228379&w=2 Mailing List
- http://marc.info/?l=bugtraq&m=142805027510172&w=2 Mailing List
- http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html Exploit, Third Party Advisory, VDB Entry
- http://rhn.redhat.com/errata/RHSA-2014-1306.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2014-1311.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2014-1312.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2014-1354.html Third Party Advisory
- http://seclists.org/fulldisclosure/2014/Oct/0 Mailing List, Third Party Advisory
- http://secunia.com/advisories/58200 Broken Link
- http://secunia.com/advisories/59272 Broken Link
- http://secunia.com/advisories/59737 Broken Link
- http://secunia.com/advisories/59907 Broken Link
- http://secunia.com/advisories/60024 Broken Link
- http://secunia.com/advisories/60034 Broken Link
- http://secunia.com/advisories/60044 Broken Link
- http://secunia.com/advisories/60055 Broken Link
- http://secunia.com/advisories/60063 Broken Link
- http://secunia.com/advisories/60193 Broken Link
- http://secunia.com/advisories/60325 Broken Link
- http://secunia.com/advisories/60433 Broken Link
- http://secunia.com/advisories/60947 Broken Link
- http://secunia.com/advisories/61065 Broken Link
- http://secunia.com/advisories/61128 Broken Link
- http://secunia.com/advisories/61129 Broken Link
- http://secunia.com/advisories/61188 Broken Link
- http://secunia.com/advisories/61283 Broken Link
- http://secunia.com/advisories/61287 Broken Link
- http://secunia.com/advisories/61291 Broken Link
- http://secunia.com/advisories/61312 Broken Link
- http://secunia.com/advisories/61313 Broken Link
- http://secunia.com/advisories/61328 Broken Link
- http://secunia.com/advisories/61442 Broken Link
- http://secunia.com/advisories/61471 Broken Link
- http://secunia.com/advisories/61479 Broken Link
- http://secunia.com/advisories/61485 Broken Link