GNU · GNU Bash
CVE-2014-6278
GNU Bash OS Command Injection Vulnerability
Cos'è
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
CISA: GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.
Cosa fare
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Scadenza per le agenzie federali USA: 23 ottobre 2025
- Aggiunta all'elenco CISA
- 2 ottobre 2025
- Pubblicato
- 30 settembre 2014
- Gravità
- Alta 8,8 CVSS 3.1
- Probabilità di attacchi nei prossimi 30 giorni (EPSS)
- 99,7% tra il 0,1% più alto di tutte le vulnerabilità note
- Tipo di debolezza
- CWE-78
- Più dettagli
- NVD · CVE.org · CISA
Tutte le fonti (20)
- http://marc.info/?l=bugtraq&m=141577137423233&w=2
- http://marc.info/?l=bugtraq&m=142721162228379&w=2
- http://marc.info/?l=bugtraq&m=142358026505815&w=2
- http://marc.info/?l=bugtraq&m=141383026420882&w=2
- http://marc.info/?l=bugtraq&m=141585637922673&w=2
- http://marc.info/?l=bugtraq&m=141576728022234&w=2
- http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.html
- http://marc.info/?l=bugtraq&m=142358078406056&w=2
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897
- http://www-01.ibm.com/support/docview.wss?uid=swg21685749
- https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk1…
- http://linux.oracle.com/errata/ELSA-2014-3093
- http://www-01.ibm.com/support/docview.wss?uid=swg21686479
- http://jvn.jp/en/jp/JVN55667175/index.html
- http://secunia.com/advisories/60433
- http://packetstormsecurity.com/files/137344/Sun-Secure-Global-Desktop-Oracle-Global-Desktop-Shellshock.html
- http://www-01.ibm.com/support/docview.wss?uid=swg21685541
- http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html
- http://secunia.com/advisories/61816
- http://secunia.com/advisories/61442
Altre falle sfruttate di GNU
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 26 gen 2026 | Argument Injection | InetUtils | Critica 9,8 | 99% |
| 21 nov 2023 | C Library Buffer Overflow | GNU C Library | Alta 7,8 | 64% |
| 28 gen 2022 | Arbitrary Code Execution | Bourne-Again Shell (Bash) | Critica 9,8 | >99,9% |
| 28 gen 2022 | Arbitrary Code Execution | Bourne-Again Shell (Bash) | Critica 9,8 | 99,9% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.