CVE-2014-6271

Published Sep 24, 2014

Last updated 6 months ago

Exploit knownCVSS critical 9.8
Shellshock

Overview

AI description

Automated description summarized from trusted sources.

CVE-2014-6271, widely known as "Shellshock," is a significant vulnerability discovered in the GNU Bash shell, which is the default command-line interpreter for most Linux distributions and macOS systems. This flaw allows for remote code execution (RCE), enabling attackers to execute arbitrary commands on a vulnerable system. The core of the vulnerability lies in how Bash processes specially crafted environment variables. Specifically, vulnerable versions of Bash fail to stop parsing after a function definition within an environment variable. As a result, any commands placed immediately after the function definition are also executed. Attackers can exploit this by injecting malicious commands into environment variables that Bash subsequently processes, such as through CGI headers in web servers, SSH services, or DHCP clients, thereby gaining the ability to run arbitrary code with the privileges of the running service.

Description
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
Source
security@debian.org
NVD status
Analyzed
Products
bash, eos, linux, qts, mageia, gluster_storage_server_for_on-premise, virtualization, enterprise_linux, enterprise_linux_desktop, enterprise_linux_eus, enterprise_linux_for_ibm_z_systems, enterprise_linux_for_power_big_endian, enterprise_linux_for_power_big_endian_eus, enterprise_linux_for_scientific_computing, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_server_from_rhui, enterprise_linux_server_tus, enterprise_linux_workstation, studio_onsite, opensuse, linux_enterprise_desktop, linux_enterprise_server, linux_enterprise_software_development_kit, debian_linux, infosphere_guardium_database_activity_monitoring, pureapplication_system, qradar_risk_manager, qradar_security_information_and_event_manager, qradar_vulnerability_manager, smartcloud_entry_appliance, smartcloud_provisioning, software_defined_network_for_virtual_environments, starter_kit_for_cloud, workload_deployer, security_access_manager_for_mobile_8.0_firmware, security_access_manager_for_web_7.0_firmware, security_access_manager_for_web_8.0_firmware, storwize_v7000_firmware, storwize_v5000_firmware, storwize_v3700_firmware, storwize_v3500_firmware, flex_system_v7000_firmware, san_volume_controller_firmware, stn6500_firmware, stn6800_firmware, stn7800_firmware, ubuntu_linux, zenworks_configuration_management, open_enterprise_server, security_gateway, big-ip_access_policy_manager, big-ip_advanced_firewall_manager, big-ip_analytics, big-ip_application_acceleration_manager, big-ip_application_security_manager, big-ip_edge_gateway, big-ip_global_traffic_manager, big-ip_link_controller, big-ip_local_traffic_manager, big-ip_policy_enforcement_manager, big-ip_protocol_security_module, big-ip_wan_optimization_manager, big-ip_webaccelerator, big-iq_cloud, big-iq_device, big-iq_security, enterprise_manager, traffix_signaling_delivery_controller, arx_firmware, netscaler_sdx_firmware, mac_os_x, vcenter_server_appliance, esx

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

CVSS 2.0

Type
Primary
Base score
10
Impact score
10
Exploitability score
10
Vector string
AV:N/AC:L/Au:N/C:C/I:C/A:C

Known exploits

Data from CISA

Vulnerability name
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
Exploit added on
Jan 28, 2022
Exploit action due
Jul 28, 2022
Required action
Apply updates per vendor instructions.

Weaknesses

nvd@nist.gov
CWE-78
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-78

Social media

Hype score
Not currently trending

  1. CVE Vulnerabilities That Shaped the Bug Bounty World A quick timeline worth knowing: 1. CVE-2014-0160 • Heartbleed - 2014 2. CVE-2014-6271 • Shellshock - 2014 3. CVE-2016-5195 • Dirty COW - 2016 4. CVE-2017-0144 • EternalBlue - 2017 5. CVE-2017-5638 • Apache Struts RC

    @konig0000

    14 Sept 2026

    113 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. CVE Vulnerabilities That Shaped the Bug Bounty World A quick timeline worth knowing: 1. CVE-2014-0160 • Heartbleed - 2014 2. CVE-2014-6271 • Shellshock - 2014 3. CVE-2016-5195 • Dirty COW - 2016 4. CVE-2017-0144 • EternalBlue - 2017 5. CVE-2017-5638 • Apache Struts RC

    @NitinGavhane_

    13 Sept 2026

    9496 Impressions

    10 Retweets

    93 Likes

    59 Bookmarks

    3 Replies

    1 Quote

  3. Top 5 Trending CVEs: 1 - CVE-2014-6271 2 - CVE-2026-35535 3 - CVE-2024-7399 4 - CVE-2025-29635 5 - CVE-2026-0628 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W

    @CVEShield

    26 Apr 2026

    223 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations

Related CVEs

  1. Google Brotli Unchecked Return Value Vulnerability•CVE-2026-111497
  2. A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion can lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services.•CVE-2026-104046
  3. A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service.•CVE-2026-104045
  4. A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.•CVE-2026-104048
  5. A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory.•CVE-2026-104047

References

Sources include official advisories and independent security research.