FreeBSD : bash -- remote code execution vulnerability (71ad81da-4414-11e4-a33e-3c970e169bc2) (Shellshock)

Critical Nessus Plugin ID 77836


The remote FreeBSD host is missing one or more security-related updates.


Chet Ramey reports :

Under certain circumstances, bash will execute user code while processing the environment for exported function definitions.

The original fix released for CVE-2014-6271 was not adequate. A similar vulnerability was discovered and tagged as CVE-2014-7169.


Update the affected packages.

See Also

Plugin Details

Severity: Critical

ID: 77836

File Name: freebsd_pkg_71ad81da441411e4a33e3c970e169bc2.nasl

Version: $Revision: 1.13 $

Type: local

Published: 2014/09/25

Modified: 2015/12/03

Dependencies: 12634

Risk Information

Risk Factor: Critical


Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:bash, p-cpe:/a:freebsd:freebsd:bash-static, p-cpe:/a:freebsd:freebsd:linux_base-c6, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2014/09/24

Vulnerability Publication Date: 2014/09/24

Exploitable With

Core Impact

Metasploit (Apache mod_cgi Bash Environment Variable Code Injection (Shellshock))

Reference Information

CVE: CVE-2014-6271, CVE-2014-7169

IAVA: 2014-A-0142