GNU Bash Local Environment Variable Handling Command Injection via Telnet (CVE-2014-7169) (Shellshock)

critical Nessus Plugin ID 77857

Language:

Synopsis

A system shell on the remote host is vulnerable to command injection.

Description

The remote host is running a version of Bash that is vulnerable to command injection via environment variable manipulation. Depending on the configuration of the system, an attacker could remotely execute arbitrary code.

Solution

Update Bash.

Plugin Details

Severity: Critical

ID: 77857

File Name: bash_remote_code_execution_telnet.nasl

Version: 1.21

Type: remote

Family: Gain a shell remotely

Published: 9/25/2014

Updated: 4/25/2023

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.0

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2014-7169

Vulnerability Information

CPE: cpe:/a:gnu:bash

Exploit Available: true

Exploit Ease: Exploits are available

Exploited by Nessus: true

Patch Publication Date: 9/24/2014

Vulnerability Publication Date: 9/24/2014

CISA Known Exploited Vulnerability Due Dates: 7/28/2022

Exploitable With

Metasploit (Apache mod_cgi Bash Environment Variable Code Injection (Shellshock))

Reference Information

CVE: CVE-2014-7169

BID: 70137

CERT: 252743

IAVA: 2014-A-0142

Detections

Analytics