CVE-2014-7169

Known Exploited Public Exploit

Description

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

Category

9.8
CVSS
Severity: Critical
CVSS 3.1 •
CVSS 2.0 •
EPSS 88.52% Top 5%
KEV Since 
Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory redhat.com Vendor Advisory marc.info Vendor Advisory ubuntu.com Vendor Advisory opensuse.org Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory opensuse.org Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory redhat.com Vendor Advisory ubuntu.com Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory opensuse.org Vendor Advisory opensuse.org Vendor Advisory neohapsis.com Vendor Advisory mandriva.com Vendor Advisory marc.info Vendor Advisory opensuse.org Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory redhat.com Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory marc.info Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory cisco.com Vendor Advisory opensuse.org
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html exploit vdb entry third party advisory
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897 third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21685749 third party advisory
http://www.openwall.com/lists/oss-security/2014/09/24/32 mailing list
http://marc.info/?l=bugtraq&m=141577137423233&w=2 vendor advisory mailing list
http://marc.info/?l=bugtraq&m=141216668515282&w=2 vendor advisory mailing list
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts third party advisory
http://marc.info/?l=bugtraq&m=141383138121313&w=2 vendor advisory mailing list
http://marc.info/?l=bugtraq&m=142721162228379&w=2 vendor advisory mailing list
http://www.securityfocus.com/archive/1/533593/100/0/threaded mailing list vdb entry broken link third party advisory
http://marc.info/?l=bugtraq&m=142358026505815&w=2 vendor advisory mailing list
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00038.html vendor advisory mailing list third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21686084 third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21686479 broken link
http://secunia.com/advisories/61188 broken link third party advisory
http://jvn.jp/en/jp/JVN55667175/index.html third party advisory
http://secunia.com/advisories/61676 broken link third party advisory
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00044.html vendor advisory mailing list third party advisory
http://secunia.com/advisories/60433 broken link third party advisory
http://marc.info/?l=bugtraq&m=141383026420882&w=2 vendor advisory mailing list
http://marc.info/?l=bugtraq&m=141585637922673&w=2 vendor advisory mailing list
http://rhn.redhat.com/errata/RHSA-2014-1306.html vendor advisory third party advisory
http://marc.info/?l=bugtraq&m=141576728022234&w=2 vendor advisory mailing list
http://www-01.ibm.com/support/docview.wss?uid=swg21685541 third party advisory
http://secunia.com/advisories/61715 broken link third party advisory
http://www.ubuntu.com/usn/USN-2363-2 vendor advisory third party advisory
http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html patch third party advisory
http://secunia.com/advisories/61816 broken link third party advisory
http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.html vendor advisory mailing list third party advisory
http://secunia.com/advisories/61442 broken link third party advisory
http://marc.info/?l=bugtraq&m=142358078406056&w=2 vendor advisory mailing list
http://marc.info/?l=bugtraq&m=142805027510172&w=2 vendor advisory mailing list
http://secunia.com/advisories/61283 broken link third party advisory
http://marc.info/?l=bugtraq&m=142113462216480&w=2 vendor advisory mailing list
https://kc.mcafee.com/corporate/index?page=content&id=SB10085 broken link
http://lists.opensuse.org/opensuse-updates/2014-10/msg00023.html vendor advisory mailing list third party advisory
http://secunia.com/advisories/61654 broken link third party advisory
http://www.novell.com/support/kb/doc.php?id=7015701 third party advisory
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315 broken link
http://secunia.com/advisories/62312 broken link third party advisory
http://secunia.com/advisories/59272 broken link third party advisory
http://marc.info/?l=bugtraq&m=141319209015420&w=2 vendor advisory mailing list
https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html third party advisory
http://marc.info/?l=bugtraq&m=141879528318582&w=2 vendor advisory mailing list
http://rhn.redhat.com/errata/RHSA-2014-1312.html vendor advisory third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21685604 third party advisory
http://www.ubuntu.com/usn/USN-2363-1 vendor advisory third party advisory
http://marc.info/?l=bugtraq&m=142118135300698&w=2 vendor advisory mailing list
http://secunia.com/advisories/61703 broken link third party advisory
http://support.apple.com/kb/HT6495 third party advisory
http://www.kb.cert.org/vuls/id/252743 third party advisory us government resource
http://secunia.com/advisories/61065 broken link third party advisory
http://linux.oracle.com/errata/ELSA-2014-3075.html third party advisory
http://marc.info/?l=bugtraq&m=141383196021590&w=2 vendor advisory mailing list
http://marc.info/?l=bugtraq&m=141383081521087&w=2 vendor advisory mailing list
http://www-01.ibm.com/support/docview.wss?uid=swg21686445 third party advisory
http://support.novell.com/security/cve/CVE-2014-7169.html third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21686131 third party advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126 third party advisory vdb entry
http://www.us-cert.gov/ncas/alerts/TA14-268A third party advisory us government resource
http://secunia.com/advisories/61641 broken link third party advisory
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00042.html vendor advisory mailing list third party advisory
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648 third party advisory
https://access.redhat.com/node/1200223 third party advisory
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00004.html vendor advisory mailing list third party advisory
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898 third party advisory
http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html broken link vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21685914 broken link
http://seclists.org/fulldisclosure/2014/Oct/0 mailing list third party advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:164 broken link vendor advisory
http://secunia.com/advisories/61619 broken link third party advisory
http://linux.oracle.com/errata/ELSA-2014-3078.html third party advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04497075 broken link
http://secunia.com/advisories/60325 broken link third party advisory
https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes broken link
http://secunia.com/advisories/60024 broken link third party advisory
http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html exploit vdb entry third party advisory
https://www.exploit-db.com/exploits/34879/ exploit vdb entry third party advisory
http://secunia.com/advisories/61622 broken link third party advisory
https://access.redhat.com/articles/1200223 third party advisory
http://secunia.com/advisories/62343 broken link third party advisory
http://advisories.mageia.org/MGASA-2014-0393.html third party advisory
http://secunia.com/advisories/61565 broken link third party advisory
https://www.suse.com/support/shellshock/ third party advisory
http://marc.info/?l=bugtraq&m=141450491804793&w=2 vendor advisory mailing list
http://secunia.com/advisories/61313 broken link third party advisory
http://secunia.com/advisories/61873 broken link third party advisory
http://secunia.com/advisories/61485 broken link third party advisory
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00041.html vendor advisory mailing list third party advisory
http://secunia.com/advisories/61618 broken link third party advisory
http://secunia.com/advisories/60947 broken link third party advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04518183 broken link
https://support.apple.com/kb/HT6535 third party advisory
http://marc.info/?l=bugtraq&m=141577297623641&w=2 vendor advisory mailing list
http://www-01.ibm.com/support/docview.wss?uid=isg3T1021272 third party advisory
http://marc.info/?l=bugtraq&m=141383244821813&w=2 vendor advisory mailing list
http://secunia.com/advisories/61312 broken link third party advisory
http://secunia.com/advisories/60193 broken link third party advisory
http://www.vmware.com/security/advisories/VMSA-2014-0010.html third party advisory
http://secunia.com/advisories/61479 broken link third party advisory
http://secunia.com/advisories/60063 broken link third party advisory
http://secunia.com/advisories/60034 broken link third party advisory
http://marc.info/?l=bugtraq&m=141330425327438&w=2 vendor advisory mailing list
http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html third party advisory
http://secunia.com/advisories/59907 broken link third party advisory
http://secunia.com/advisories/58200 broken link third party advisory
http://marc.info/?l=bugtraq&m=141577241923505&w=2 vendor advisory mailing list
http://secunia.com/advisories/61643 broken link third party advisory
http://twitter.com/taviso/statuses/514887394294652929 third party advisory
http://www.novell.com/support/kb/doc.php?id=7015721 third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21687079 third party advisory
http://secunia.com/advisories/61503 broken link third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21686246 third party advisory
http://rhn.redhat.com/errata/RHSA-2014-1354.html vendor advisory third party advisory
http://marc.info/?l=bugtraq&m=141216207813411&w=2 vendor advisory mailing list
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004915 third party advisory
http://marc.info/?l=bugtraq&m=141383465822787&w=2 vendor advisory mailing list
http://www.qnap.com/i/en/support/con_show.php?cid=61 third party advisory
http://marc.info/?l=bugtraq&m=141694386919794&w=2 vendor advisory mailing list
http://secunia.com/advisories/61552 broken link third party advisory
http://secunia.com/advisories/61780 broken link third party advisory
http://www-01.ibm.com/support/docview.wss?uid=isg3T1021279 third party advisory
https://support.citrix.com/article/CTX200223 permissions required
http://linux.oracle.com/errata/ELSA-2014-3077.html third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21686447 broken link
http://secunia.com/advisories/62228 broken link third party advisory
http://marc.info/?l=bugtraq&m=141330468527613&w=2 vendor advisory mailing list
http://secunia.com/advisories/61855 broken link third party advisory
http://marc.info/?l=bugtraq&m=141235957116749&w=2 vendor advisory mailing list
http://secunia.com/advisories/60044 broken link third party advisory
http://secunia.com/advisories/61291 broken link third party advisory
http://marc.info/?l=bugtraq&m=141345648114150&w=2 vendor advisory mailing list
http://secunia.com/advisories/59737 broken link third party advisory
http://secunia.com/advisories/61287 broken link third party advisory
http://marc.info/?l=bugtraq&m=141383353622268&w=2 vendor advisory mailing list
http://secunia.com/advisories/61711 broken link third party advisory
http://www-01.ibm.com/support/docview.wss?uid=isg3T1021361 third party advisory
http://marc.info/?l=bugtraq&m=141383304022067&w=2 vendor advisory mailing list
http://rhn.redhat.com/errata/RHSA-2014-1311.html vendor advisory third party advisory
http://secunia.com/advisories/61128 broken link third party advisory
http://www.debian.org/security/2014/dsa-3035 vendor advisory mailing list third party advisory
https://support.citrix.com/article/CTX200217 third party advisory
http://secunia.com/advisories/61471 broken link third party advisory
http://secunia.com/advisories/60055 broken link third party advisory
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash vendor advisory third party advisory
http://secunia.com/advisories/61550 broken link third party advisory
http://secunia.com/advisories/61633 broken link third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21686494 third party advisory
http://linux.oracle.com/errata/ELSA-2014-1306.html third party advisory
https://kb.bluecoat.com/index?page=content&id=SA82 broken link
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00048.html vendor advisory mailing list third party advisory
http://secunia.com/advisories/61328 broken link third party advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21685733 third party advisory
http://secunia.com/advisories/61129 broken link third party advisory
http://secunia.com/advisories/61700 broken link third party advisory
http://secunia.com/advisories/61626 broken link third party advisory
http://secunia.com/advisories/61603 broken link third party advisory
http://secunia.com/advisories/61857 broken link third party advisory
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004879 third party advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/1008-security-advisory-0006 third party advisory

Frequently Asked Questions

What is the severity of CVE-2014-7169?
CVE-2014-7169 has been scored as a critical severity vulnerability.
How to fix CVE-2014-7169?
To fix CVE-2014-7169, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2014-7169 being actively exploited in the wild?
It is confirmed that CVE-2014-7169 is actively exploited. Be extra cautious if you are using vulnerable components. According to its EPSS score, there is a ~89% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.