Industrial Cybersecurity Threat Briefing
“Vulnerability Summary for CVE-2014-6277,” National Vulnerability Database, September 28, 2014, modified October 9,…
2 passages name itOriginal (opens in a new tab) ↗
CVE-2014-6277 Public exploit EPSS 64.3%
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables…
Summary
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in environment variable values, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted environment. This affects systems where environment setting occurs across a privilege boundary from Bash execution, such as OpenSSH sshd with ForceCommand, Apache HTTP Server mod_cgi and mod_cgid, and scripts run by DHCP clients.
Official description · CVE.org
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
64.4 / 100
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 1
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 3 years after disclosure. Public exploit code (Exploit-DB) appeared 2 days after disclosure.
- Disclosedday 0
- Public exploit codeExploit-DB+2 days
- First seen exploitedVulnCheck KEV evidence+3 yrs
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
See the family treeA fix was bypassed or incomplete 3 times over 6 days.
Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.
incomplete fixHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Stated in the CVE text
NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
- Stated in the CVE text
NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
- Similar weakness in the same product (machine-matched)same product + CWE + description similarity
- Stated in the CVE text
incomplete fixHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Stated in the CVE text
NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
This CVECVE-2014-6277GNU Bash through 4.3 bash43-026 does not properly parse function…27 Sep 2014- Stated in the CVE text
incomplete fixHigh
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
- Stated in the CVE text
NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
- Stated in the CVE text
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo high- or medium-confidence techniques. The 2 available links are lower confidence and listed below.
Lower-confidence links (2)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Unix ShellT1059.004 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
- Exploit Public-Facing ApplicationT1190 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
What security researchers reported
Named in 1 threat report1 reportboozallen.com
Reports are matched by finding the exact id CVE-2014-6277 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Also mentioned in 1 community threat pulse (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.