CVE-2014-6277
HighSummary
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted environment.
Risk Assessment
Attackers can exploit this vulnerability to gain control over the system or disrupt its operation, potentially leading to serious consequences for the organization.
Recommendation
It is recommended to update GNU Bash to the latest version to mitigate this vulnerability and to monitor environments where Bash is used for potential attack attempts.
Other vulnerabilities in GNU Bash
See all- CVE-2014-7187High
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops.
- CVE-2014-7186High
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents.
Original NVD description (English source)
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.