CVE-2014-6278

Bash shell has a critical vulnerability where attackers can execute arbitrary commands by crafting malicious environment variables with fake function definitions. This is especially dangerous in systems like SSH and web servers that pass environment data to Bash.

CVE-2014-6278 is a command injection vulnerability in GNU Bash through 4.3 where improper parsing of function definitions in environment variables allows remote code execution when Bash processes attacker-controlled environment data across privilege boundaries. Attack vectors include OpenSSH ForceCommand, Apache mod_cgi/mod_cgid, and DHCP clients; exploitation requires ability to set environment variables in a context where Bash will parse them.