CVE-2014-6278

HIGH

Description

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.

References

http://jvn.jp/en/jp/JVN55667175/index.html

http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126

http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html

http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html

http://linux.oracle.com/errata/ELSA-2014-3093

http://linux.oracle.com/errata/ELSA-2014-3094

http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00004.html

http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.html

http://marc.info/?l=bugtraq&m=141330468527613&w=2

http://marc.info/?l=bugtraq&m=141345648114150&w=2

http://marc.info/?l=bugtraq&m=141383026420882&w=2

http://marc.info/?l=bugtraq&m=141383081521087&w=2

http://marc.info/?l=bugtraq&m=141383196021590&w=2

http://marc.info/?l=bugtraq&m=141383244821813&w=2

http://marc.info/?l=bugtraq&m=141383304022067&w=2

http://marc.info/?l=bugtraq&m=141383353622268&w=2

http://marc.info/?l=bugtraq&m=141383465822787&w=2

http://marc.info/?l=bugtraq&m=141450491804793&w=2

http://marc.info/?l=bugtraq&m=141576728022234&w=2

http://marc.info/?l=bugtraq&m=141577137423233&w=2

http://marc.info/?l=bugtraq&m=141577241923505&w=2

http://marc.info/?l=bugtraq&m=141577297623641&w=2

http://marc.info/?l=bugtraq&m=141585637922673&w=2

http://marc.info/?l=bugtraq&m=141879528318582&w=2

http://marc.info/?l=bugtraq&m=142118135300698&w=2

http://marc.info/?l=bugtraq&m=142358026505815&w=2

http://marc.info/?l=bugtraq&m=142358078406056&w=2

http://marc.info/?l=bugtraq&m=142721162228379&w=2

http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html

http://packetstormsecurity.com/files/137344/Sun-Secure-Global-Desktop-Oracle-Global-Desktop-Shellshock.html

http://secunia.com/advisories/58200

http://secunia.com/advisories/59907

http://secunia.com/advisories/59961

http://secunia.com/advisories/60024

http://secunia.com/advisories/60034

http://secunia.com/advisories/60044

http://secunia.com/advisories/60055

http://secunia.com/advisories/60063

http://secunia.com/advisories/60193

http://secunia.com/advisories/60325

http://secunia.com/advisories/60433

http://secunia.com/advisories/61065

http://secunia.com/advisories/61128

http://secunia.com/advisories/61129

http://secunia.com/advisories/61283

http://secunia.com/advisories/61287

http://secunia.com/advisories/61291

http://secunia.com/advisories/61312

http://secunia.com/advisories/61313

http://secunia.com/advisories/61328

http://secunia.com/advisories/61442

http://secunia.com/advisories/61471

http://secunia.com/advisories/61485

http://secunia.com/advisories/61503

http://secunia.com/advisories/61550

http://secunia.com/advisories/61552

http://secunia.com/advisories/61565

http://secunia.com/advisories/61603

http://secunia.com/advisories/61633

http://secunia.com/advisories/61641

http://secunia.com/advisories/61643

http://secunia.com/advisories/61654

http://secunia.com/advisories/61703

http://secunia.com/advisories/61780

http://secunia.com/advisories/61816

http://secunia.com/advisories/61857

http://secunia.com/advisories/62312

http://secunia.com/advisories/62343

http://support.novell.com/security/cve/CVE-2014-6278.html

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash

http://www.mandriva.com/security/advisories?name=MDVSA-2015:164

http://www.novell.com/support/kb/doc.php?id=7015721

http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html

http://www.qnap.com/i/en/support/con_show.php?cid=61

http://www.ubuntu.com/usn/USN-2380-1

http://www.vmware.com/security/advisories/VMSA-2014-0010.html

http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272

http://www-01.ibm.com/support/docview.wss?uid=isg3T1021279

http://www-01.ibm.com/support/docview.wss?uid=isg3T1021361

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004879

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898

http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004915

http://www-01.ibm.com/support/docview.wss?uid=swg21685541

http://www-01.ibm.com/support/docview.wss?uid=swg21685604

http://www-01.ibm.com/support/docview.wss?uid=swg21685733

http://www-01.ibm.com/support/docview.wss?uid=swg21685749

http://www-01.ibm.com/support/docview.wss?uid=swg21685914

http://www-01.ibm.com/support/docview.wss?uid=swg21686131

http://www-01.ibm.com/support/docview.wss?uid=swg21686246

http://www-01.ibm.com/support/docview.wss?uid=swg21686445

http://www-01.ibm.com/support/docview.wss?uid=swg21686479

http://www-01.ibm.com/support/docview.wss?uid=swg21686494

http://www-01.ibm.com/support/docview.wss?uid=swg21687079

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315

https://bugzilla.redhat.com/show_bug.cgi?id=1147414

https://kb.bluecoat.com/index?page=content&id=SA82

https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648

https://kc.mcafee.com/corporate/index?page=content&id=SB10085

https://security-tracker.debian.org/tracker/CVE-2014-6278

https://support.citrix.com/article/CTX200217

https://support.citrix.com/article/CTX200223

https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04497075

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04518183

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts

https://www.exploit-db.com/exploits/39568/

https://www.exploit-db.com/exploits/39887/

https://www.suse.com/support/shellshock/

Details

Source: MITRE

Published: 2014-09-30

Updated: 2018-08-09

Type: CWE-78

Risk Information

CVSS v2.0

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 10

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:gnu:bash:1.14.0:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:1.14.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:1.14.2:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:1.14.3:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:1.14.4:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:1.14.5:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:1.14.6:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:1.14.7:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:2.0:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:2.01:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:2.01.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:2.02:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:2.02.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:2.03:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:2.04:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:2.05:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:2.05:a:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:2.05:b:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:3.0:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:3.0.16:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:3.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:3.2:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:3.2.48:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:4.0:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:4.0:rc1:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:4.1:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:4.2:*:*:*:*:*:*:*

cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:*

Tenable Plugins

View all (37 total)

IDNameProductFamilySeverity
112578GNU Bash Environment Variable Handling Code Injection (Shellshock)Web Application ScanningComponent Vulnerability
critical
95529openSUSE Security Update : bash (openSUSE-2016-1374) (Shellshock)NessusSuSE Local Security Checks
critical
95282SUSE SLED12 / SLES12 Security Update : bash (SUSE-SU-2016:2872-1) (Shellshock)NessusSuSE Local Security Checks
critical
88514Oracle Solaris Third-Party Patch Update : bash (multiple_vulnerabilities_in_bash1) (Shellshock)NessusSolaris Local Security Checks
critical
87680VMware ESX Multiple Bash Vulnerabilities (VMSA-2014-0010) (Shellshock)NessusMisc.
critical
85630IBM Storwize V7000 Unified 1.3.x < 1.4.3.5 / 1.5.x < 1.5.0.4 Multiple Vulnerabilities (Shellshock)NessusMisc.
critical
82581GNU Bash Incomplete Fix Remote Code Injection (Shellshock)NessusCGI abuses
critical
82417Mandriva Linux Security Advisory : bash (MDVSA-2015:164)NessusMandriva Local Security Checks
critical
80590Oracle Solaris Third-Party Patch Update : bash (multiple_vulnerabilities_in_bash) (Shellshock)NessusSolaris Local Security Checks
critical
80196Juniper Junos Space GNU Bash Command Injection Vulnerability (JSA10648) (Shellshock)NessusJunos Local Security Checks
critical
79584Cisco TelePresence Conductor Bash Remote Code Execution (Shellshock)NessusCISCO
critical
79376Oracle Linux 5 : bash (ELSA-2014-3094) (Shellshock)NessusOracle Linux Local Security Checks
critical
79375Oracle Linux 6 : bash (ELSA-2014-3093) (Shellshock)NessusOracle Linux Local Security Checks
critical
79374Oracle Linux 7 : bash (ELSA-2014-3092) (Shellshock)NessusOracle Linux Local Security Checks
critical
79234McAfee Next Generation Firewall GNU Bash Code Injection (SB10085) (Shellshock)NessusMisc.
critical
79215McAfee Web Gateway GNU Bash Code Injection (SB10085) (Shellshock)NessusMisc.
critical
79147VMware vCenter Converter 5.1.x < 5.1.2 / 5.5.x < 5.5.3 Multiple Vulnerabilities (VMSA-2014-0010) (Shellshock)NessusWindows
critical
79124CUCM IM and Presence Service GNU Bash Environment Variable Handling Command Injection (CSCur05454) (Shellshock)NessusCISCO
critical
79123McAfee Email Gateway GNU Bash Code Injection (SB10085) (Shellshock)NessusMisc.
critical
78889VMware vCenter Operations Management Bash Vulnerabilities (VMSA-2014-0010) (Shellshock)NessusMisc.
critical
78857VMware Workspace Portal Multiple Bash Shell Vulnerabilities (VMSA-2014-0010) (Shellshock)NessusMisc.
critical
78828Cisco Prime Security Manager GNU Bash Environment Variable Handling Command Injection (cisco-sa-20140926-bash) (Shellshock)NessusCGI abuses
critical
78827Cisco ASA Next-Generation Firewall GNU Bash Environment Variable Handling Command Injection (cisco-sa-20140926-bash) (Shellshock)NessusCISCO
critical
78826VMware NSX Bash Environment Variable Command Injection (VMSA-2014-0010) (Shellshock)NessusMisc.
critical
78771VMware vSphere Replication Bash Environment Variable Command Injection Vulnerability (VMSA-2014-0010) (Shellshock)NessusMisc.
critical
78770Cisco UCS Director Code Injection (CSCur02877) (Shellshock)NessusCISCO
critical
78693Cisco NX-OS GNU Bash Environment Variable Command Injection Vulnerability (cisco-sa-20140926-bash) (Shellshock)NessusCISCO
critical
78596Cisco TelePresence Video Communication Server Bash Remote Code Execution (Shellshock)NessusCISCO
critical
78591openSUSE Security Update : bash (openSUSE-SU-2014:1310-1) (Shellshock)NessusSuSE Local Security Checks
critical
78508VMware vCenter Server Appliance Bash Remote Code Execution (VMSA-2014-0010) (Shellshock)NessusMisc.
critical
78395Oracle third party patch update : bash_2014_10_07NessusSolaris Local Security Checks
critical
78260Ubuntu 10.04 LTS / 12.04 LTS / 14.04 LTS : bash vulnerabilities (USN-2380-1) (Shellshock)NessusUbuntu Local Security Checks
critical
78197F5 Networks BIG-IP : Multiple GNU Bash vulnerabilities (SOL15629) (Shellshock)NessusF5 Networks Local Security Checks
critical
78067Bash Remote Code Execution (CVE-2014-6277 / CVE-2014-6278) (Shellshock)NessusGain a shell remotely
critical
78060GLSA-201410-01 : Bash: Multiple vulnerabilities (Shellshock)NessusGentoo Local Security Checks
critical
78025VMSA-2014-0010 : VMware product updates address critical Bash security vulnerabilities (Shellshock)NessusVMware ESX Local Security Checks
critical
78016FreeBSD : bash -- remote code execution (512d1301-49b9-11e4-ae2c-c80aa9043978) (Shellshock)NessusFreeBSD Local Security Checks
critical