SECUFOCUSNOW
Home›CVE index›CVE-2014-7169
CISA KEV · Known exploitedCritical

CVE-2014-7169

GNU Bourne-Again Shell (Bash)

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an...

CVSS
9.8
EPSS
99.9%
100.0% percentile
CISA KEV
Listed
Published
2014.09.25
PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV
Exploit probability99.9%
Technical severityCVSS 9.8

Vulnerability overview

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an...

Affected product and versions

Product
GNU Bourne-Again Shell (Bash)
Affected versions
<= 4.3, >= 4.9.0 < 4.9.12, >= 4.10.0 < 4.10.9, >= 4.11.0 < 4.11.11, >= 4.12.0 < 4.12.9, >= 4.13.0 < 4.13.9, >= 4.14.0 < 4.14.4f, 4, 5, 6, < 4.1.1, 4.1.1, 3.0, 4.0, 2.1, 3.4, 5.0, 6.0, 7.0
Fixed versions
4.9.12, 4.10.9, 4.11.11, 4.12.9, 4.13.9, 4.14.4f, 4.1.1, 1.2.1, 1.4.3.5, 1.5.0.4, 7.2.0.9, 7.3.0.7, 7.1.0.11, 3.8.0.07, 3.9.1.08, 4.1.2.06, r77.30, 9.3.67.5r1, 10.1.129.11r1, 10.5.52.11r1

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
CISA required action

Apply updates per vendor instructions.

Due date: 2022.07.28
  1. 1
    Identify

    Confirm that GNU Bourne-Again Shell (Bash) and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-78
KEV added
2022.01.28
Ransomware use
미확인