CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution, actively exploited

Description

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Check Point Security Gateway< r77.30

F5 Big-ip Access Policy Manager≥ 10.1.0 ≤ 10.2.4 · ≥ 11.0.0 ≤ 11.5.1 · 11.6.0

F5 Big-ip Advanced Firewall Manager≥ 11.3.0 ≤ 11.5.1 · 11.6.0

F5 Big-ip Analytics≥ 11.0.0 ≤ 11.5.1 · 11.6.0

F5 Big-ip Application Acceleration Manager≥ 11.4.0 ≤ 11.5.1 · 11.6.0

F5 Big-ip Application Security Manager≥ 10.0.0 ≤ 10.2.4 · ≥ 11.0.0 ≤ 11.5.1 · 11.6.0

F5 Big-ip Edge Gateway≥ 10.1.0 ≤ 10.2.4 · ≥ 11.0.0 ≤ 11.3.0

F5 Big-ip Global Traffic Manager≥ 10.0.0 ≤ 10.2.4 · ≥ 11.0.0 ≤ 11.5.1 · 11.6.0

F5 Big-ip Link Controller≥ 10.0.0 ≤ 10.2.4 · ≥ 11.0.0 ≤ 11.5.1 · 11.6.0

F5 Big-ip Local Traffic Manager≥ 10.0.0 ≤ 10.2.4 · ≥ 11.0.0 ≤ 11.5.1 · 11.6.0

F5 Big-ip Policy Enforcement Manager≥ 11.3.0 ≤ 11.5.1 · 11.6.0

F5 Big-ip Protocol Security Module≥ 10.0.0 ≤ 10.2.4 · ≥ 11.0.0 ≤ 11.4.1

F5 Big-ip Wan Optimization Manager≥ 10.0.0 ≤ 10.2.4 · ≥ 11.0.0 ≤ 11.3.0

F5 Big-ip Webaccelerator≥ 10.0.0 ≤ 10.2.4 · ≥ 11.0.0 ≤ 11.3.0

F5 Big-iq Cloud≥ 4.0.0 ≤ 4.4.0

F5 Big-iq Device≥ 4.2.0 ≤ 4.4.0

F5 Big-iq Security≥ 4.0.0 ≤ 4.4.0

F5 Enterprise Manager≥ 2.1.0 ≤ 2.3.0 · ≥ 3.0.0 ≤ 3.1.1

F5 Traffix Signaling Delivery Controller≥ 4.0.0 ≤ 4.0.5 · 3.3.2 · 3.4.1 · 3.5.1

Gnu Bash≤ 4.3

IBM Infosphere Guardium Database Activity Monitoring8.2 · 9.0 · 9.1

IBM Pureapplication System≥ 1.0.0.0 ≤ 1.0.0.4 · ≥ 1.1.0.0 ≤ 1.1.0.4 · 2.0.0.0

IBM Qradar Risk Manager7.1.0

IBM Qradar Security Information And Event Manager7.1.0 · 7.1.1 · 7.1.2 · 7.2

Remediation

Fixed in

Check Point Security Gateway≥ r77.30

Patch & vendor advisories

References

http://advisories.mageia.org/MGASA-2014-0388.htmlThird Party Advisory
http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.htmlBroken LinkThird Party Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126Third Party AdvisoryVDB EntryVendor Advisory
http://jvn.jp/en/jp/JVN55667175/index.htmlVendor Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673Third Party Advisory
http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.htmlExploitIssue TrackingThird Party Advisory
http://linux.oracle.com/errata/ELSA-2014-1293.htmlThird Party Advisory
http://linux.oracle.com/errata/ELSA-2014-1294.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00028.htmlMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00029.htmlMailing ListThird Party Advisory

and 161 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2014-6271 being actively exploited?

Yes. CVE-2014-6271 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 28 Jan 2022.

How severe is CVE-2014-6271?

CVE-2014-6271 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 100.0% probability of exploitation.

Which products are affected by CVE-2014-6271?

Affected products include Check Point Security Gateway, F5 Big-ip Access Policy Manager, F5 Big-ip Advanced Firewall Manager, F5 Big-ip Analytics, F5 Big-ip Application Acceleration Manager, and 19 more.

How do I fix CVE-2014-6271?

Upgrade affected software to a fixed version, for example Check Point Security Gateway r77.30 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2014-6271 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo