GNU · Bourne-Again Shell (Bash)
GNU Bash through version 4.3 mishandles trailing strings after function definitions in environment variable values, a flaw in the Bourne-Again Shell (Bash) component that is known as ShellShock. An attacker who can supply a crafted environment across a privilege boundary, such as through the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in Apache HTTP Server, or scripts run by certain DHCP clients, can execute arbitrary code, and no authentication or user interaction is needed.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
First seen exploited 6 days after disclosure. Public exploit code (PoC-in-GitHub) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
A fix was bypassed or incomplete 3 times over 6 days.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
CVE-2014-6271 allows environment variables set from service/HTTP requests on a serve (e.g. HTTP_COOKIE) in Bash shell that allows for spawning a child shell with the authority/privilege level of the parent shell to perform RCE of code provided by the adversary in the request.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2014-6271 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
PHP code injection vulnerability affecting phpMyAdminSID: 2281CVE-2014-6271: RCE affecting GNU bash system, specific the SMTP (this was part of the Shellshock CVEs)SID: 31975 - 31978, 31985, 32038, 32039, 32041 - 32043, 32069, 32335, 32336CVE-2017-3881: RCE for Cisco switchesSID: 41909 -…
“Vulnerability Summary for CVE-2014-6271,” National Vulnerability Database, September 24, 2014, modified June 28, 2016,…
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.