CVE-2014-7169

Fixed in a distro release ExploitedEPSS 100%CVSS 9.8

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

Published 2014-09-25 · In CISA KEV since 2022-01-28 · CVE record · OSV

Products: gnu bash, arista eos, oracle linux, qnap qts, mageia, redhat gluster_storage_server_for_on-premise, redhat virtualization, redhat enterprise_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_for_ibm_z_systems, redhat enterprise_linux_for_power_big_endian, redhat enterprise_linux_for_power_big_endian_eus, redhat enterprise_linux_for_scientific_computing, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_from_rhui, redhat enterprise_linux_server_tus, redhat enterprise_linux_workstation, suse studio_onsite, opensuse, suse linux_enterprise_desktop, suse linux_enterprise_server, suse linux_enterprise_software_development_kit, debian_linux, ibm infosphere_guardium_database_activity_monitoring, ibm pureapplication_system, ibm qradar_risk_manager, ibm qradar_security_information_and_event_manager, ibm qradar_vulnerability_manager, ibm smartcloud_entry_appliance, ibm smartcloud_provisioning, ibm software_defined_network_for_virtual_environments, ibm starter_kit_for_cloud, ibm workload_deployer, ibm security_access_manager_for_mobile_8.0_firmware, ibm security_access_manager_for_web_7.0_firmware, ibm security_access_manager_for_web_8.0_firmware, ibm storwize_v7000_firmware, ibm storwize_v5000_firmware, ibm storwize_v3700_firmware, ibm storwize_v3500_firmware, ibm flex_system_v7000_firmware, ibm san_volume_controller_firmware, ibm stn6500_firmware, ibm stn6800_firmware, ibm stn7800_firmware, canonical ubuntu_linux, novell zenworks_configuration_management, novell open_enterprise_server, checkpoint security_gateway, f5 big-ip_access_policy_manager, f5 big-ip_advanced_firewall_manager, f5 big-ip_analytics, f5 big-ip_application_acceleration_manager, f5 big-ip_application_security_manager, f5 big-ip_edge_gateway, f5 big-ip_global_traffic_manager, f5 big-ip_link_controller, f5 big-ip_local_traffic_manager, f5 big-ip_policy_enforcement_manager, f5 big-ip_protocol_security_module, f5 big-ip_wan_optimization_manager, f5 big-ip_webaccelerator, f5 big-iq_cloud, f5 big-iq_device, f5 big-iq_security, f5 enterprise_manager, f5 traffix_signaling_delivery_controller, f5 arx_firmware, citrix netscaler_sdx_firmware, apple mac_os_x, vmware vcenter_server_appliance, vmware esx

Distro releases