gnu bash CVE-2014-7169 vulnerability in GNU and Other Products
Published on September 25, 2014

product logo product logo product logo product logo product logo product logo product logo product logo product logo product logo product logo product logo product logo product logo product logo product logo product logo
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

NVD

Known Exploited Vulnerability

This GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.

The following remediation steps are recommended / required by July 28, 2022: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2014-7169 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. It has the highest possible exploitability rating (3.9). The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.

What is a Shell injection Vulnerability?

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

CVE-2014-7169 has been classified to as a Shell injection vulnerability or weakness.


Products Associated with CVE-2014-7169

You can be notified by stack.watch whenever vulnerabilities like CVE-2014-7169 are published in these products:

GNU Bash
 
Arista Eos
 
Oracle Linux
 
Qnap Qts
 
Mageia
 
Red Hat Enterprise Linux Desktop
 
Red Hat Enterprise Linux Server
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Enterprise Linux Scientific Computing
 
Red Hat Enterprise Linux Workstation
 
Red Hat Enterprise Linux Server Aus
 
Red Hat Enterprise Linux Server Tus
 
Red Hat Enterprise Linux Eus
 
Red Hat Enterprise Linux Power Big Endian Eus
 
Red Hat Enterprise Linux Server From Rhui
 
Red Hat Enterprise Linux Power Big Endian
 
Red Hat Gluster Storage Server On Premise
 
Red Hat Enterprise Linux Ibm Z Systems
 
Red Hat Virtualization
 
Suse Linux Enterprise Desktop
 
Suse Linux Enterprise Server
 
OpenSuse
 
Suse Studio Onsite
 
Suse Linux Enterprise Software Development Kit
 
Debian Linux
 
IBM Qradar Vulnerability Manager
 
IBM Qradar Security Information Event Manager
 
IBM Security Access Manager Web 7 0 Firmware
 
IBM Pureapplication System
 
IBM Security Access Manager Mobile 8 0 Firmware
 
IBM Security Access Manager Web 8 0 Firmware
 
IBM Smartcloud Provisioning
 
IBM Qradar Risk Manager
 
IBM Smartcloud Entry Appliance
 
IBM Starter Kit For Cloud
 
IBM Software Defined Network Virtual Environments
 
IBM Infosphere Guardium Database Activity Monitoring
 
IBM Workload Deployer
 
Canonical Ubuntu Linux
 
Novell Zenworks Configuration Management
 
Novell Open Enterprise Server
 
Checkpoint Security Gateway
 
F5 Networks Big Ip Analytics
 
F5 Networks Big Ip Application Security Manager
 
F5 Networks Big Ip Advanced Firewall Manager
 
F5 Networks Big Ip Global Traffic Manager
 
F5 Networks Big Ip Local Traffic Manager
 
F5 Networks Big Ip Link Controller
 
F5 Networks Big Ip Application Acceleration Manager
 
F5 Networks Big Ip Policy Enforcement Manager
 
F5 Networks Big Ip Access Policy Manager
 
F5 Networks Big Ip Edge Gateway
 
F5 Networks Big Ip Webaccelerator
 
F5 Networks Big Ip Wan Optimization Manager
 
F5 Networks Enterprise Manager
 
F5 Networks Big Ip Protocol Security Module
 
F5 Networks Traffix Signaling Delivery Controller
 
F5 Networks Big Iq Security
 
F5 Networks Big Iq Device
 
F5 Networks Big Iq Cloud
 
Apple macOS
 
VMware Vcenter Server Appliance
 
VMware Esx
 
Apache HTTP Server
 

What versions are vulnerable to CVE-2014-7169?

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.

Each of the following must match for the vulnerability to exist.