GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: debian
Published: 2014-09-27T22:00:00
Updated: 2024-08-06T12:10:13.286Z
Reserved: 2014-09-09T00:00:00
Link: CVE-2014-6277
Vulnrichment
No data.
NVD
Status : Modified
Published: 2014-09-27T22:55:02.660
Modified: 2018-08-09T01:29:01.437
Link: CVE-2014-6277
Redhat