CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
9.0 | $0-$5k | 0.00 |
A vulnerability was found in GNU Bash and classified as critical. Affected by this issue is an unknown functionality of the component Patch User Script Handler. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability.
The weakness was disclosed 09/27/2014 by Michal Zalewski as Bash bug: apply Florian's patch now (CVE-2014-6277 and CVE-2014-6278) as confirmed posting (Blog). The advisory is shared for download at lcamtuf.blogspot.com. This vulnerability is handled as CVE-2014-6278 since 09/09/2014. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.
A public exploit has been developed by lastc0de and been published immediately after the advisory. The exploit is available at lcamtuf.blogspot.ch. It is declared as highly functional. The vulnerability scanner Nessus provides a plugin with the ID 82581 (GNU Bash Incomplete Fix Remote Code Injection (Shellshock)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family CGI abuses and running in the context r. The commercial vulnerability scanner Qualys is able to test this issue with plugin 195641 (Ubuntu Security Notification for Bash Vulnerabilities (USN-2380-1)). The code used by the exploit is:
foo='() { echo not patched; }' bash -c foo
Applying a patch is able to eliminate this problem. A possible mitigation has been published 22 hours after the disclosure of the vulnerability. Attack attempts may be identified with Snort ID 31975. Furthermore it is possible to detect and prevent this kind of attack with TippingPoint and the filter 16798.
The vulnerability is also documented in the databases at X-Force (96687), Tenable (82581) and Exploit-DB (39887). bugzilla.redhat.com is providing further details. The entries 67711 and 68865 are pretty similar.
Affected
- Apple iPhone (Jailbreak only)
- Apple Mac OS X up to 10.9.4
- Debian GNU/Linux up to 4.1-3/4.2
- F5 BIG-IP up to 11.6.0
- Madravia Linux 1.0
- Palo Alto PAN-OS up to 6.0
- Red Hat Linux 4/5/6/7
- Slackware Linux up to 14.1
- SuSE openSUSE 11.0
- Ubuntu Linux up to 14.04 LTS
- VMware Fusion
Not Affected
- Android Default Installation
- FreeBSD Default Installation
- NetBSD Default Installation
- OpenBSD Default Installation
Product
Vendor
Name
Version
- 1.14.0
- 1.14.1
- 1.14.2
- 1.14.3
- 1.14.4
- 1.14.5
- 1.14.6
- 1.14.7
- 2.0
- 2.01
- 2.01.1
- 2.02
- 2.02.1
- 2.03
- 2.04
- 2.05
- 3.0
- 3.0.16
- 3.1
- 3.2
- 3.2.48
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 10.0VulDB Meta Temp Score: 9.0
VulDB Base Score: 10.0
VulDB Temp Score: 9.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Os command injectionCWE: CWE-78 / CWE-74 / CWE-707
ATT&CK: T1202
Local: No
Remote: Yes
Availability: 🔍
Access: Public
Status: Highly functional
Author: lastc0de
Download: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Nessus ID: 82581
Nessus Name: GNU Bash Incomplete Fix Remote Code Injection (Shellshock)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍
OpenVAS ID: 103414
OpenVAS Name: GNU Bash Environment Variable Handling Shell Remote Command Execution Vulnerability (SIP Check)
OpenVAS File: 🔍
OpenVAS Family: 🔍
Saint ID: bash_shellshock_ucsmgr
Saint Name: Bash environment variable command injection in Cisco UCS Manager
Qualys ID: 🔍
Qualys Name: 🔍
MetaSploit ID: apache_mod_cgi_bash_env.rb
MetaSploit Name: Apache ActiveMQ Directory Traversal
MetaSploit File: 🔍
Exploit-DB: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Exploit Delay Time: 🔍
Snort ID: 31975
Snort Message: OS-OTHER Bash CGI environment variable injection attempt
Snort Class: 🔍
TippingPoint: 🔍
McAfee IPS: 🔍
McAfee IPS Version: 🔍
Fortigate IPS: 🔍
Timeline
09/09/2014 🔍09/24/2014 🔍
09/27/2014 🔍
09/27/2014 🔍
09/27/2014 🔍
09/28/2014 🔍
09/28/2014 🔍
09/30/2014 🔍
10/01/2014 🔍
04/06/2015 🔍
03/01/2016 🔍
06/06/2016 🔍
02/21/2022 🔍
Sources
Vendor: gnu.orgAdvisory: Bash bug: apply Florian's patch now (CVE-2014-6277 and CVE-2014-6278)
Researcher: Michal Zalewski
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2014-6278 (🔍)
OVAL: 🔍
IAVM: 🔍
X-Force: 96687 - GNU Bash user scripts code execution, High Risk
Vulnerability Center: 56922 - GNU Bash Through 4.3 bash43-026 Remote Code Execution via a Crafted Environment - CVE-2014-6278, Critical
SecurityFocus: 70166 - GNU Bash CVE-2014-6278 Incomplete Fix Remote Code Execution Vulnerability
Secunia: 61641 - Blue Coat Multiple Products Bash Multiple Vulnerabilities, Highly Critical
scip Labs: https://www.scip.ch/en/?labs.20161013
Misc.: 🔍
See also: 🔍
Entry
Created: 10/01/2014 10:48Updated: 02/21/2022 08:41
Changes: 10/01/2014 10:48 (98), 08/25/2018 09:26 (16), 02/21/2022 08:41 (3)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.