CVE-2014-6271

Published Sep 24, 2014

Last updated 4 months ago

Exploit knownCVSS critical 9.8
Shellshock

Overview

Description
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
Source
security@debian.org
NVD status
Deferred
Products
bash, eos, linux, qts, mageia, gluster_storage_server_for_on-premise, virtualization, enterprise_linux, enterprise_linux_desktop, enterprise_linux_eus, enterprise_linux_for_ibm_z_systems, enterprise_linux_for_power_big_endian, enterprise_linux_for_power_big_endian_eus, enterprise_linux_for_scientific_computing, enterprise_linux_server, enterprise_linux_server_aus, enterprise_linux_server_from_rhui, enterprise_linux_server_tus, enterprise_linux_workstation, studio_onsite, opensuse, linux_enterprise_desktop, linux_enterprise_server, linux_enterprise_software_development_kit, debian_linux, infosphere_guardium_database_activity_monitoring, pureapplication_system, qradar_risk_manager, qradar_security_information_and_event_manager, qradar_vulnerability_manager, smartcloud_entry_appliance, smartcloud_provisioning, software_defined_network_for_virtual_environments, starter_kit_for_cloud, workload_deployer, security_access_manager_for_mobile_8.0_firmware, security_access_manager_for_web_7.0_firmware, security_access_manager_for_web_8.0_firmware, storwize_v7000_firmware, storwize_v5000_firmware, storwize_v3700_firmware, storwize_v3500_firmware, flex_system_v7000_firmware, san_volume_controller_firmware, stn6500_firmware, stn6800_firmware, stn7800_firmware, ubuntu_linux, zenworks_configuration_management, open_enterprise_server, security_gateway, big-ip_access_policy_manager, big-ip_advanced_firewall_manager, big-ip_analytics, big-ip_application_acceleration_manager, big-ip_application_security_manager, big-ip_edge_gateway, big-ip_global_traffic_manager, big-ip_link_controller, big-ip_local_traffic_manager, big-ip_policy_enforcement_manager, big-ip_protocol_security_module, big-ip_wan_optimization_manager, big-ip_webaccelerator, big-iq_cloud, big-iq_device, big-iq_security, enterprise_manager, traffix_signaling_delivery_controller, arx_firmware, netscaler_sdx_firmware, mac_os_x, vcenter_server_appliance, esx

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

CVSS 2.0

Type
Primary
Base score
10
Impact score
10
Exploitability score
10
Vector string
AV:N/AC:L/Au:N/C:C/I:C/A:C

Known exploits

Data from CISA

Vulnerability name
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
Exploit added on
Jan 28, 2022
Exploit action due
Jul 28, 2022
Required action
Apply updates per vendor instructions.

Weaknesses

nvd@nist.gov
CWE-78
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-78

Social media

Hype score
Not currently trending

Configurations

Related CVEs

  1. A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occurs because a privileged D-Bus method responsible for exporting encryption metadata does not perform a policy check. As a result, sensitive cryptographic metadata can be read and written to attacker-controlled locations. This weakens the confidentiality guarantees of encrypted storage volumes.•CVE-2026-26104
  2. A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization checks. The issue allows a local unprivileged user to instruct the root-owned udisks daemon to overwrite encryption metadata on block devices. This can permanently invalidate encryption keys and render encrypted volumes inaccessible. Successful exploitation results in a denial-of-service condition through irreversible data loss.•CVE-2026-26103
  3. A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3350 build 20251216 and later QuTS hero h5.3.2.3354 build 20251225 and later QuTS hero h5.2.8.3350 build 20251216 and later•CVE-2025-66277
  4. A use of uninitialized variable vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to denial of service conditions, or modify control flow in unexpected ways. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later•CVE-2025-58466
  5. A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later•CVE-2025-47205

References

Sources include official advisories and independent security research.