#VU5294 Command injection in Bash - CVE-2014-7169

Vulnerability identifier: #VU5294

Vulnerability risk: Critical

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2014-7169

CWE-ID: CWE-77

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Bash
Universal components / Libraries / Scripting languages

Vendor: GNU

Description

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The weakness exists due to an incomplete fix related to malformed function definitions in the values of environment variables. By using multiple attack vectors (DHCP, HTTP, SIP, FTP, and SMTP) involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, a remote attacker can inject and execute arbitrary commands.This vulnerability exists due to incomplete fix for vulnerability #1 (CVE-2014-6271).

Exploitation example:

env X='() { (a)=>\' bash -c "echo date"; cat echo

Successful exploitation may allow an attacker to gain complete control over vulnerable system.

Note: this vulnerability was being actively exploited.

Mitigation
Update GNU Bash to version 4.3 bash43-027.

Vulnerable software versions

Bash: 1.14.0 - 4.3

---

External links
https://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.