Back to CVE Browser

CVE-2014-6278

Known Exploited (CISA KEV)HIGH

8.8

CVSS Severity Score

EPSS Score75.2660%

EPSS Percentile89.24th

PublishedSep 30, 2014

Last ModifiedApr 22, 2026

Vulnerability Description

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.

Affected Platforms (CPE)

📦

Gnu

Bash

= 1.14.0

📦

Gnu

Bash

= 1.14.1

📦

Gnu

Bash

= 1.14.2

📦

Gnu

Bash

= 1.14.3

📦

Gnu

Bash

= 1.14.4

📦

Gnu

Bash

= 1.14.5

📦

Gnu

Bash

= 1.14.6

📦

Gnu

Bash

= 1.14.7

📦

Gnu

Bash

= 2.0

📦

Gnu

Bash

= 2.01

📦

Gnu

Bash

= 2.01.1

📦

Gnu

Bash

= 2.02

📦

Gnu

Bash

= 2.02.1

📦

Gnu

Bash

= 2.03

📦

Gnu

Bash

= 2.04

📦

Gnu

Bash

= 2.05

📦

Gnu

Bash

= 2.05

📦

Gnu

Bash

= 2.05

📦

Gnu

Bash

= 3.0

📦

Gnu

Bash

= 3.0.16

📦

Gnu

Bash

= 3.1

📦

Gnu

Bash

= 3.2

📦

Gnu

Bash

= 3.2.48

📦

Gnu

Bash

= 4.0

📦

Gnu

Bash

= 4.0

📦

Gnu

Bash

= 4.1

📦

Gnu

Bash

= 4.2

📦

Gnu

Bash

= 4.3

References & Advisories

🔗 http://jvn.jp/en/jp/JVN55667175/index.html

🔗 http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126

🔗 http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html

🔗 http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html

🔗 http://linux.oracle.com/errata/ELSA-2014-3093

🔗 http://linux.oracle.com/errata/ELSA-2014-3094

🔗 http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00004.html

🔗 http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.html

Related Vulnerabilities

CVE-2014-718710.0

Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a ...

CVE-2014-718610.0

The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service ...

CVE-1999-040810.0

Files created from interactive shell sessions in Cobalt RaQ microservers (e.g. .bash_history) are world readable, and thus are acc...

CVE-2014-627710.0

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows ...