#VU5322 Command injection in Bash - CVE-2014-6278

Vulnerability identifier: #VU5322

Vulnerability risk: Critical

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2014-6278

CWE-ID: CWE-77

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Bash
Universal components / Libraries / Scripting languages

Vendor: GNU

Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an incomplete fix related to the parsing of user scripts. By using attack vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, a remote attacker can execute arbitrary code with privileges of the current user. The vulnerability was introduced by incorrect patching of vulnerabilities #1 (CVE-2014-6271),  #2 (CVE-2014-7169) and #3 (CVE-2014-6277)

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.

Mitigation
Update GNU Bash to version 4.3 bash43-027.

Vulnerable software versions

Bash: 1.14.0 - 4.3

---

External links
https://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.