Debian DSA-3032-1 : bash - security update

critical Nessus Plugin ID 77825


The remote Debian host is missing a security-related update.


Stephane Chazelas discovered a vulnerability in bash, the GNU Bourne-Again Shell, related to how environment variables are processed. In many common configurations, this vulnerability is exploitable over the network, especially if bash has been configured as the system shell.


Upgrade the bash packages.

For the stable distribution (wheezy), this problem has been fixed in version 4.2+dfsg-0.1+deb7u1.

See Also

Plugin Details

Severity: Critical

ID: 77825

File Name: debian_DSA-3032.nasl

Version: 1.8

Type: local

Agent: unix

Published: 9/25/2014

Updated: 1/31/2022

Supported Sensors: Frictionless Assessment Agent, Nessus Agent

Risk Information


Risk Factor: Critical

Score: 9.5


Risk Factor: Critical

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:bash, cpe:/o:debian:debian_linux:7.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/24/2014

CISA Known Exploited Dates: 7/28/2022

Exploitable With

Core Impact

Metasploit (Apache mod_cgi Bash Environment Variable Code Injection (Shellshock))

Reference Information

CVE: CVE-2014-6271

DSA: 3032

IAVA: 2014-A-0142