GNU Bash versions 1.14 through 4.3 contain a flaw that processes commands placed after function definitions in the added environment variable, allowing remote attackers to execute arbitrary code via a crafted environment which enables network-based exploitation.

Original disclosure: http://www.openwall.com/lists/oss-security/2014/09/24/11

Detailed analysis by lcamtuf:

http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html
http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html

redhat 3

openvas 29

exploitpack 8

packetstorm 26

seebug 4

zdt 20

metasploit 5

saint 12

thn 3

oraclelinux 2

threatpost 3

suse 4

mageia 1

slackware 2

debian 4

kitploit 1

exploitdb 4

nessus 28

myhack58 1

gentoo 1

amazon 1

securityvulns 7

fedora 3

osv 2

centos 1

ubuntu 1

cisa_kev 2

ibm 1

nvd 2

veracode 1

ubuntucve 1

archlinux 1

lenovo 1

nuclei 1

cloudfoundry 1

cve 1

checkpoint_security 1

prion 3

paloalto 1

debiancve 2

attackerkb 1

cvelist 1

freebsd 1

symantec 1

redhat

(RHSA-2014:1293) Critical: bash security update

2014-09-24 00:00:00

(RHSA-2014:1295) Critical: bash Shift_JIS security update

2014-09-24 00:00:00

(RHSA-2014:1294) Critical: bash security update

2014-09-24 00:00:00

openvas

RedHat Update for bash RHSA-2014:1293-01

2014-09-25 00:00:00

Cisco NX-OS: GNU Bash Environment Variable Command Injection Vulnerability

2016-05-12 00:00:00

GNU Bash Environment Variable Command Injection Vulnerability

2016-05-10 00:00:00

exploitpack

TrendMicro InterScan Web Security Virtual Appliance - Shellshock Remote Command Injection

2016-10-21 00:00:00

PHP 5.6.2 - Shellshock Safe Mode disable_functions Bypass Command Injection

2014-11-03 00:00:00

Cisco Unified Communications Manager - Multiple Vulnerabilities

2015-08-18 00:00:00

packetstorm

GNU Bash 4.3 Command Injection

2014-09-29 00:00:00

Bash Environment Variable Command Execution

2014-09-25 00:00:00

DHCP Client Bash Environment Variable Code Injection

2014-09-26 00:00:00

seebug

OpenVPN 2.2.29 - ShellShock Exploit

2014-10-10 00:00:00

GNU bash Environment Variable Command Injection (MSF)

2014-09-29 00:00:00

IPFire Cgi Web Interface Authenticated Bash Environment Variable Code Injection exploit

2014-10-10 00:00:00

zdt

QNAP Web Server Remote Code Execution via Bash Environment Variable Code Injection Exploit

2015-03-27 00:00:00

Cisco 11.0.1 Unified Communications Manager Command Execution Vulnerability

2015-08-14 00:00:00

RedStar 3.0 Server - BEAM & RSSMON Command Execution (Shellshock) Exploit

2016-12-19 00:00:00

metasploit

Advantech Switch Bash Environment Variable Code Injection (Shellshock)

2015-12-01 17:33:45

IPFire Bash Environment Variable Injection (Shellshock)

2016-05-30 00:40:12

Apache mod_cgi Bash Environment Variable Injection (Shellshock) Scanner

2014-09-25 06:19:14

saint

Bash environment variable code injection over HTTP

2014-09-26 00:00:00

Bash Environment Variable Handling Shell Command Injection Via CUPS

2014-11-05 00:00:00

Bash environment variable code injection over HTTP

2014-09-26 00:00:00

thn

BASHLITE Malware leverages ShellShock Bug to Hijack Devices Running BusyBox

2014-11-17 03:01:00

Remotely Exploitable 'Bash Shell' Vulnerability Affects Linux, Unix and Apple Mac OS X

2014-09-24 20:19:00

Hackers Using 'Shellshock' Bash Vulnerability to Launch Botnet Attacks

2014-09-26 20:07:00

oraclelinux

bash security update

2014-09-24 00:00:00

bash security update

2014-09-24 00:00:00

threatpost

Patching Bash Vulnerability a Challenge for ICS, SCADA

2014-09-25 14:34:38

Bash Botnet Exploit Found, Bash Patches Incomplete

2014-09-25 11:41:51

Bash Vulnerability Exploits Dropping DDoS Bots

2014-09-25 16:30:59

suse

Important security fix for bash that allows the injection of commands. (important)

2014-09-28 12:09:20

Security update for bash (critical)

2014-09-27 01:04:16

bash (critical)

2014-09-30 17:06:26

mageia

Updated bash packages fix CVE-2014-6271

2014-09-24 22:42:05

slackware

[slackware-security] bash

2014-09-24 23:37:00

[slackware-security] bash

2014-09-29 19:33:36

debian

[SECURITY] [email protected]

2014-09-24 15:22:47

[SECURITY] [DSA 3032-1] bash security update

2014-09-24 14:06:06

[SECURITY] [email protected]

2014-09-24 15:22:27

kitploit

xShock - Shellshock Exploit

2020-03-19 11:30:00

exploitdb

Qmail SMTP 1.03 - Bash Environment Variable Injection

2020-07-08 00:00:00

RedStar 3.0 Server - 'Shellshock' 'BEAM' / 'RSSMON' Command Injection

2016-12-18 00:00:00

IPFire - 'Shellshock' Bash Environment Variable Command Injection (Metasploit)

2016-06-10 00:00:00

nessus

SIP Script Remote Command Execution via Shellshock

2014-11-03 00:00:00

Oracle Linux 4 : bash (ELSA-2014-1294) (Shellshock)

2014-09-25 00:00:00

CentOS 5 / 6 / 7 : bash (CESA-2014:1293) (Shellshock)

2014-09-25 00:00:00

myhack58

From the parsing perspective analysis of the Shellshock Vulnerability[CVE-2 0 1 4-6 2 7 1]-vulnerability warning-the black bar safety net

2014-09-28 00:00:00

gentoo

Bash: Code Injection

2014-09-24 00:00:00

amazon

Critical: bash

2014-09-24 07:48:00

securityvulns

Re: [oss-security] CVE-2014-6271: remote code execution through bash

2014-09-25 00:00:00

Cisco Unified Communications Manager Multiple Vulnerabilities (VP2015-001)

2015-08-17 00:00:00

Re: [oss-security] CVE-2014-6271: remote code execution through bash

2014-09-25 00:00:00

fedora

[SECURITY] Fedora 21 Update: bash-4.3.22-3.fc21

2014-09-27 10:03:24

[SECURITY] Fedora 21 Update: bash-4.3.25-2.fc21

2014-09-27 10:08:26

[SECURITY] Fedora 20 Update: bash-4.2.48-2.fc20

2014-09-26 09:03:00

osv

bash - security update

2014-09-24 00:00:00

bash - security update

2014-09-25 00:00:00

centos

bash security update

2014-09-24 15:07:20

ubuntu

Bash vulnerability

2014-09-24 00:00:00

cisa_kev

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

2022-01-28 00:00:00

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

2022-01-28 00:00:00

ibm

Security Bulletin: IBM Tivoli Workload Scheduler (CVE-2014-6271, CVE-2014-7169)

2018-06-17 14:50:13

nvd

CVE-2014-6271

2014-09-24 18:48:04

CVE-2014-7169

2014-09-25 01:55:04

veracode

Arbitrary File Overwrite

2019-01-15 09:02:02

ubuntucve

CVE-2014-6271

2014-09-24 00:00:00

archlinux

bash: Remote code execution

2014-09-26 00:00:00

lenovo

GNU Bourne-Again Shell (Bash) 'Shellshock' - Lenovo Support US

2016-11-16 00:00:00

nuclei

ShellShock - Remote Code Execution

2020-10-01 18:03:35

cloudfoundry

CVE-2014-6271 and CVE-2014-7169 - ShellShock | Cloud Foundry

2014-09-25 00:00:00

cve

CVE-2014-6271

2014-09-24 18:48:04

checkpoint_security

Check Point Response to CVE-2014-6271 and CVE-2014-7169 Bash Code Injection vulnerability

2014-09-24 21:00:00

prion

Design/Logic Flaw

2014-09-25 01:55:00

Design/Logic Flaw

2014-09-24 18:48:00

Design/Logic Flaw

2015-01-13 11:59:00

paloalto

Bash Shell remote code execution (CVE-2014-6271, CVE-2014-7169)

2014-09-24 00:00:00

debiancve

CVE-2014-6271

2014-09-24 18:48:04

CVE-2014-7169

2014-09-25 01:55:04

attackerkb

CVE-2014-7169

2014-09-25 00:00:00

cvelist

CVE-2014-7169

2014-09-25 01:00:00

freebsd

bash -- remote code execution vulnerability

2014-09-24 00:00:00

symantec

GNU Bash CVE-2014-6271 Remote Code Execution Vulnerability

2014-09-24 00:00:00

Solutions

Vulnerabilities intelligence
Perimeter control tool
Linux scanner
Windows scanner
Developers SDK
Security Intelligence feeds

Database

Vulnerabilities
Exploits
Security News
BugBounty
Wild Exploited
Top Vulnerabilities
CVE Feed

Resources

Statics & Sources
Plugins
API docs
FAQ
Blog
Glossary

Company

About
Contacts
Pricing
EULA
Privacy Policy
Submission Policy
OpenSource

@2024 Vulners Inc

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.976 High

EPSS

Percentile

100.0%

JSON

Related for H1:29839