GNU · GNU Bash
CVE-2014-6278
GNU Bash OS Command Injection Vulnerability
Was es ist
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
CISA: GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.
Was zu tun ist
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Frist für US-Bundesbehörden: 23. Oktober 2025
- Zur CISA-Liste hinzugefügt
- 2. Oktober 2025
- Veröffentlicht
- 30. September 2014
- Schweregrad
- Hoch 8,8 CVSS 3.1
- Wahrscheinlichkeit von Angriffen in den nächsten 30 Tagen (EPSS)
- 99,7% unter den obersten 0,1% aller bekannten Schwachstellen
- Schwachstellentyp
- CWE-78
- Mehr Details
- NVD · CVE.org · CISA
Alle Quellen (20)
- http://marc.info/?l=bugtraq&m=141577137423233&w=2
- http://marc.info/?l=bugtraq&m=142721162228379&w=2
- http://marc.info/?l=bugtraq&m=142358026505815&w=2
- http://marc.info/?l=bugtraq&m=141383026420882&w=2
- http://marc.info/?l=bugtraq&m=141585637922673&w=2
- http://marc.info/?l=bugtraq&m=141576728022234&w=2
- http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.html
- http://marc.info/?l=bugtraq&m=142358078406056&w=2
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897
- http://www-01.ibm.com/support/docview.wss?uid=swg21685749
- https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk1…
- http://linux.oracle.com/errata/ELSA-2014-3093
- http://www-01.ibm.com/support/docview.wss?uid=swg21686479
- http://jvn.jp/en/jp/JVN55667175/index.html
- http://secunia.com/advisories/60433
- http://packetstormsecurity.com/files/137344/Sun-Secure-Global-Desktop-Oracle-Global-Desktop-Shellshock.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21685541
- http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html
- http://secunia.com/advisories/61816
- http://secunia.com/advisories/61442
Weitere ausgenutzte Schwachstellen von GNU
| Hinzugefügt | Schwachstelle | Produkt | Schweregrad | Angriffswahrscheinlichkeit |
|---|---|---|---|---|
| 26.01.2026 | Argument Injection | InetUtils | Kritisch 9,8 | 99% |
| 21.11.2023 | C Library Buffer Overflow | GNU C Library | Hoch 7,8 | 64% |
| 28.01.2022 | Arbitrary Code Execution | Bourne-Again Shell (Bash) | Kritisch 9,8 | >99,9% |
| 28.01.2022 | Arbitrary Code Execution | Bourne-Again Shell (Bash) | Kritisch 9,8 | 99,9% |
Quellen: Known Exploited Vulnerabilities (CISA, gemeinfrei), CVE records (cve.org) und EPSS (FIRST). Die Angriffswahrscheinlichkeit ist die EPSS-Schätzung, dass jemand in den nächsten 30 Tagen versucht, die Schwachstelle auszunutzen.