CVE-2014-6271 Shellshock: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution
Remote attackers can execute arbitrary code via crafted environment variables in GNU Bash, affecting systems using Bash for CGI, SSH, or DHCP.
- Exploited in the wild
- Since 28 Jan 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-6271?
CVE-2014-6271 (Shellshock) is a critical command injection vulnerability in Apple Mac Os X, published on 24 Sep 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
Weakness: CWE-78
Which versions are affected by CVE-2014-6271?
It affects 74 products.
Linux distribution packages (40)
bash Red Hat:enterprise_linux:5::client | All versions | 0:3.2-33.el5.1 |
bash-debuginfo Red Hat:enterprise_linux:5::client | All versions | 0:3.2-33.el5.1 |
bash Red Hat:enterprise_linux:5::server | All versions | 0:3.2-33.el5.1 |
bash-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:3.2-33.el5.1 |
bash Red Hat:enterprise_linux:6::client | All versions | 0:4.1.2-15.el6_5.1 |
bash-debuginfo Red Hat:enterprise_linux:6::client | All versions | 0:4.1.2-15.el6_5.1 |
bash-doc Red Hat:enterprise_linux:6::client | All versions | 0:4.1.2-15.el6_5.1 |
bash Red Hat:enterprise_linux:6::computenode | All versions | 0:4.1.2-15.el6_5.1 |
bash-debuginfo Red Hat:enterprise_linux:6::computenode | All versions | 0:4.1.2-15.el6_5.1 |
bash-doc Red Hat:enterprise_linux:6::computenode | All versions | 0:4.1.2-15.el6_5.1 |
bash Red Hat:enterprise_linux:6::server | All versions | 0:4.1.2-15.el6_5.1 |
bash-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:4.1.2-15.el6_5.1 |
bash-doc Red Hat:enterprise_linux:6::server | All versions | 0:4.1.2-15.el6_5.1 |
bash Red Hat:enterprise_linux:6::workstation | All versions | 0:4.1.2-15.el6_5.1 |
bash-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 0:4.1.2-15.el6_5.1 |
bash-doc Red Hat:enterprise_linux:6::workstation | All versions | 0:4.1.2-15.el6_5.1 |
bash Red Hat:enterprise_linux:7::client | All versions | 0:4.2.45-5.el7_0.2 |
bash-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:4.2.45-5.el7_0.2 |
bash-doc Red Hat:enterprise_linux:7::client | All versions | 0:4.2.45-5.el7_0.2 |
bash Red Hat:enterprise_linux:7::computenode | All versions | 0:4.2.45-5.el7_0.2 |
bash-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:4.2.45-5.el7_0.2 |
bash-doc Red Hat:enterprise_linux:7::computenode | All versions | 0:4.2.45-5.el7_0.2 |
bash Red Hat:enterprise_linux:7::server | All versions | 0:4.2.45-5.el7_0.2 |
bash-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:4.2.45-5.el7_0.2 |
bash-doc Red Hat:enterprise_linux:7::server | All versions | 0:4.2.45-5.el7_0.2 |
bash Red Hat:enterprise_linux:7::workstation | All versions | 0:4.2.45-5.el7_0.2 |
bash-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:4.2.45-5.el7_0.2 |
bash-doc Red Hat:enterprise_linux:7::workstation | All versions | 0:4.2.45-5.el7_0.2 |
bash Red Hat:rhel_els:4::as | All versions | 0:3.0-27.el4.2 |
bash-debuginfo Red Hat:rhel_els:4::as | All versions | 0:3.0-27.el4.2 |
bash Red Hat:rhel_els:4::es | All versions | 0:3.0-27.el4.2 |
bash-debuginfo Red Hat:rhel_els:4::es | All versions | 0:3.0-27.el4.2 |
bash Red Hat:rhel_eus:5.9 | All versions | 0:3.2-32.el5_9.2 |
bash-debuginfo Red Hat:rhel_eus:5.9 | All versions | 0:3.2-32.el5_9.2 |
bash Red Hat:rhel_eus:6.4::computenode | All versions | 0:4.1.2-15.el6_4.1 |
bash-debuginfo Red Hat:rhel_eus:6.4::computenode | All versions | 0:4.1.2-15.el6_4.1 |
bash-doc Red Hat:rhel_eus:6.4::computenode | All versions | 0:4.1.2-15.el6_4.1 |
bash Red Hat:rhel_eus:6.4::server | All versions | 0:4.1.2-15.el6_4.1 |
bash-debuginfo Red Hat:rhel_eus:6.4::server | All versions | 0:4.1.2-15.el6_4.1 |
bash-doc Red Hat:rhel_eus:6.4::server | All versions | 0:4.1.2-15.el6_4.1 |
Products include Apple Mac Os X, Arista Eos, Canonical Ubuntu Linux, Checkpoint Security Gateway, Citrix Netscaler Sdx Firmware, Debian Debian Linux and 68 more.
How do I fix CVE-2014-6271?
Apply the vendor's patch. US federal agencies must fix it by 28 Jul 2022.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2014-6271 being exploited?
Yes. Attackers have exploited CVE-2014-6271 in the wild since at least 28 Jan 2022.
Public exploit code: 10 Metasploit modules, 21 Exploit-DB entries, 1 Nuclei template and 96 proofs of concept on GitHub.
Other vulnerabilities in Apple Mac Os X
Sources
Also known as CVE-2014-3671, CVE-2014-62771, CVE-2014-7227, DEBIAN-CVE-2014-6271, DLA-59-1, DSA-3032-1 and 7 more.