CVE-2014-6277
Published · Updated
57Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actepss 64%
from disclosure to weapon2 days
Published on NVDSep 27
1st PoC+2d
VulnCheck+1251d
exploitation probability
64%top 1% of all CVEs
observed exploitation
yesVulnCheck
4 public exploit(s)
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Not affected
5 products (9 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 4 · Red Hat Enterprise Linux 5 · Red Hat Enterprise Virtualization 3
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
Affected products
n/a · n/apublic PoCs found — 4✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/35081exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/36933exploitdbwww.exploit-db.com/exploits/34860unverifiedcve_referencepacketstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126http://jvn.jp/en/jp/JVN55667175/index.htmlhttp://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.htmlhttp://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.htmlhttp://linux.oracle.com/errata/ELSA-2014-3093http://linux.oracle.com/errata/ELSA-2014-3094http://lists.apple.com/archives/security-announce/2015/Jan/msg00003.htmlhttp://lists.apple.com/archives/security-announce/2015/Sep/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00004.htmlhttp://lists.opensuse.org/opensuse-updates/2014-10/msg00025.htmlhttp://marc.info/?l=bugtraq&m=141330468527613&w=2http://marc.info/?l=bugtraq&m=141345648114150&w=2