9.8Crítica KEV

CVE-2014-7169GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

gnu bash; arista eos; oracle linux; qnap qts Publicada: 2014-09-25 04:00 (hace 12 años)

Explotación conocida — GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

CISA confirmó el 28.01.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 28.07.2022.

Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2014-7169

Descripción

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

Debilidad (CWE): CWE-78

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Fabricante	Producto	Versiones
apple	mac os x	10.0.0 – < 10.10.0
arista	eos	4.9.0 – < 4.9.12
canonical	ubuntu linux	10.04
checkpoint	security gateway	< r77.30
citrix	netscaler sdx firmware	< 9.3.67.5r1
debian	debian linux	7.0
f5	arx firmware	6.0.0 – ≤ 6.4.0
f5	big-ip access policy manager	10.1.0 – ≤ 10.2.4
f5	big-ip advanced firewall manager	11.3.0 – ≤ 11.5.1
f5	big-ip analytics	11.0.0 – ≤ 11.5.1
f5	big-ip application acceleration manager	11.4.0 – ≤ 11.5.1
f5	big-ip application security manager	10.0.0 – ≤ 10.2.4
f5	big-ip edge gateway	10.1.0 – ≤ 10.2.4
f5	big-ip global traffic manager	10.0.0 – ≤ 10.2.4
f5	big-ip link controller	10.0.0 – ≤ 10.2.4
f5	big-ip local traffic manager	10.0.0 – ≤ 10.2.4
f5	big-ip policy enforcement manager	11.3.0 – ≤ 11.5.1
f5	big-ip protocol security module	10.0.0 – ≤ 10.2.4
f5	big-ip wan optimization manager	10.0.0 – ≤ 10.2.4
f5	big-ip webaccelerator	10.0.0 – ≤ 10.2.4
f5	big-iq cloud	4.0.0 – ≤ 4.4.0
f5	big-iq device	4.2.0 – ≤ 4.4.0
f5	big-iq security	4.0.0 – ≤ 4.4.0
f5	enterprise manager	2.1.0 – ≤ 2.3.0
f5	traffix signaling delivery controller	4.0.0 – ≤ 4.0.5
gnu	bash	≤ 4.3
ibm	flex system v7000 firmware	1.1.0.0 – < 7.1.0.11
ibm	infosphere guardium database activity monitoring	8.2
ibm	pureapplication system	1.0.0.0 – ≤ 1.0.0.4
ibm	qradar risk manager	7.1.0
ibm	qradar security information and event manager	7.1.0
ibm	qradar vulnerability manager	7.2.0
ibm	san volume controller firmware	1.1.0.0 – < 7.1.0.11
ibm	security access manager for mobile 8.0 firmware	8.0.0.1
ibm	security access manager for web 7.0 firmware	7.0.0.1
ibm	security access manager for web 8.0 firmware	8.0.0.2
ibm	smartcloud entry appliance	2.3.0
ibm	smartcloud provisioning	2.1.0
ibm	software defined network for virtual environments	< 1.2.1
ibm	starter kit for cloud	2.2.0
ibm	stn6500 firmware	3.8.0.0 – < 3.8.0.07
ibm	stn6800 firmware	3.8.0.0 – < 3.8.0.07
ibm	stn7800 firmware	3.8.0.0 – < 3.8.0.07
ibm	storwize v3500 firmware	1.1.0.0 – < 7.1.0.11
ibm	storwize v3700 firmware	1.1.0.0 – < 7.1.0.11
ibm	storwize v5000 firmware	1.1.0.0 – < 7.1.0.11
ibm	storwize v7000 firmware	1.1.0.0 – < 1.4.3.5
ibm	workload deployer	3.1.0 – ≤ 3.1.0.7
mageia	mageia	3.0
novell	open enterprise server	2.0
novell	zenworks configuration management	10.3
opensuse	opensuse	12.3
oracle	linux	4
qnap	qts	< 4.1.1
redhat	enterprise linux	4.0
redhat	enterprise linux desktop	5.0
redhat	enterprise linux eus	5.9
redhat	enterprise linux for ibm z systems	5.9_s390x
redhat	enterprise linux for power big endian	5.0_ppc
redhat	enterprise linux for power big endian eus	6.5_ppc64
redhat	enterprise linux for scientific computing	6.0
redhat	enterprise linux server	5.0
redhat	enterprise linux server aus	5.6
redhat	enterprise linux server from rhui	5.0
redhat	enterprise linux server tus	6.5
redhat	enterprise linux workstation	5.0
redhat	gluster storage server for on-premise	2.1
redhat	virtualization	3.4
suse	linux enterprise desktop	11
suse	linux enterprise server	10
suse	linux enterprise software development kit	11
suse	studio onsite	1.3
vmware	esx	4.0
vmware	vcenter server appliance	5.0

Referencias y parches

http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html ExploitThird Party AdvisoryVDB Entry
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897 Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21685749 Third Party Advisory
[oss-security] 20140924 Re: CVE-2014-6271: remote code execution through bash mailing-listMailing List
HPSBMU03165 vendor-advisoryMailing List
HPSBHF03119 vendor-advisoryMailing List
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk1…
HPSBST03131 vendor-advisoryMailing List
SSRT101819 vendor-advisoryMailing List
20141001 NEW VMSA-2014-0010 - VMware product updates address critical Bash security vulnerabilities mailing-listBroken LinkThird Party AdvisoryVDB Entry
HPSBMU03245 vendor-advisoryMailing List
openSUSE-SU-2014:1229 vendor-advisoryMailing ListThird Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21686084 Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21686479 Broken Link
61188 third-party-advisoryBroken Link
JVN#55667175 third-party-advisoryThird Party Advisory
61676 third-party-advisoryBroken Link
openSUSE-SU-2014:1254 vendor-advisoryMailing ListThird Party Advisory
60433 third-party-advisoryBroken Link
HPSBMU03143 vendor-advisoryMailing List
HPSBMU03182 vendor-advisoryMailing List
RHSA-2014:1306 vendor-advisoryThird Party Advisory
HPSBST03155 vendor-advisoryMailing List
http://www-01.ibm.com/support/docview.wss?uid=swg21685541 Third Party Advisory
61715 third-party-advisoryBroken Link
USN-2363-2 vendor-advisoryThird Party Advisory
http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html PatchThird Party Advisory
61816 third-party-advisoryBroken Link
openSUSE-SU-2014:1310 vendor-advisoryMailing ListThird Party Advisory
61442 third-party-advisoryBroken Link
HPSBMU03246 vendor-advisoryMailing List
HPSBST03195 vendor-advisoryMailing List
61283 third-party-advisoryBroken Link
SSRT101711 vendor-advisoryMailing List
https://kc.mcafee.com/corporate/index?page=content&id=SB10085 Broken Link
openSUSE-SU-2014:1308 vendor-advisoryMailing ListThird Party Advisory
61654 third-party-advisoryBroken Link
http://www.novell.com/support/kb/doc.php?id=7015701 Third Party Advisory
http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315 Broken Link
62312 third-party-advisoryBroken Link
59272 third-party-advisoryBroken Link
HPSBST03122 vendor-advisoryMailing List
https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html
HPSBMU03217 vendor-advisoryMailing List
RHSA-2014:1312 vendor-advisoryThird Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21685604 Third Party Advisory
USN-2363-1 vendor-advisoryThird Party Advisory
SSRT101868 vendor-advisoryMailing List
61703 third-party-advisoryBroken Link
http://support.apple.com/kb/HT6495 Third Party Advisory
VU#252743 third-party-advisoryThird Party AdvisoryUS Government Resource
61065 third-party-advisoryBroken Link
http://linux.oracle.com/errata/ELSA-2014-3075.html Third Party Advisory
HPSBST03129 vendor-advisoryMailing List
HPSBMU03144 vendor-advisoryMailing List
http://www-01.ibm.com/support/docview.wss?uid=swg21686445 Third Party Advisory
http://support.novell.com/security/cve/CVE-2014-7169.html Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21686131 Third Party Advisory
JVNDB-2014-000126 third-party-advisoryThird Party AdvisoryVDB Entry
TA14-268A third-party-advisoryThird Party AdvisoryUS Government Resource

Coincidencias CPE (NVD) (60)

cpe:2.3:a:gnu:bash:*:*:*:*:*:*:*:* ≤ 4.3
cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:* ≥ 4.9.0 < 4.9.12
cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:* ≥ 4.10.0 < 4.10.9
cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:* ≥ 4.11.0 < 4.11.11
cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:* ≥ 4.12.0 < 4.12.9
cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:* ≥ 4.13.0 < 4.13.9
cpe:2.3:o:arista:eos:*:*:*:*:*:*:*:* ≥ 4.14.0 < 4.14.4f
cpe:2.3:o:oracle:linux:4:*:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:* < 4.1.1
cpe:2.3:o:qnap:qts:4.1.1:-:*:*:*:*:*:*
cpe:2.3:o:qnap:qts:4.1.1:build_0927:*:*:*:*:*:*
cpe:2.3:o:mageia:mageia:3.0:*:*:*:*:*:*:*
cpe:2.3:o:mageia:mageia:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:virtualization:3.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:5.9:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:5.9_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.4_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:6.5_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.3_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.4_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.5_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.6_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.7_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:5.0_ppc:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:5.9_ppc:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.0_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:6.4_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:6.5_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.3_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.5_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.6_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:5.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:*:*:*:*:*:*:*

Puntuación CVSS

9.8Crítica

Fuente: CISA-ADP · CVSS 3.1

Vector de ataque: Red
Complejidad: Baja
Privilegios: Ninguno
Interacción del usuario: Ninguna
Alcance: Sin cambio
Confidencialidad: Alto
Integridad: Alto
Disponibilidad: Alto

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Todas las puntuaciones (4)

CISA-ADP	CVSS 3.1	9.8Crítica
nvd	CVSS 3.1	9.8Crítica
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	9.8Crítica
nvd	CVSS 2.0	10.0Alta

EPSS (probabilidad de explotación en 30 días)

99.94%

superior al 100 % de todas las CVE

Evaluación de CISA (SSVC)

Explotación: active
Automatizable: yes
Impacto técnico: total

Cronología

ID reservado2014-09-24
Publicada2014-09-25 04:00
Llegó a IP-DB2026-10-24 23:34
Añadida a KEV2022-01-28
Última actualización2026-06-17 03:14

Asignada por (CNA): mitre
Estado en NVD: Analyzed

Ver en la fuente: CVE.org · NVD

Reciba un aviso cuando estos productos tengan una vulnerabilidad nueva

Activar alertas por correo

Gratis · con cuenta · se desactiva cuando quiera

CVE recientes del mismo producto — Check Point

5.4Media

CVE-2026-73860 ayer

CRIU: Parasite hijack triggered by snapshot of malicious software

checkpoint-restore criu

CRIU is a checkpoint and restore tool for Linux. Prior to 4.2.1, CRIU injects a syscall;int3 sequence at the start of the first executable virtual memory area and resumes the target process to execute parasite code. Malicious code in the target process can ke…

9.8Crítica

CVE-2026-93616 KEV hace 1 mes

Directory Traversal and File upload allows execution of arbitrary script on the Management Server

checkpoint Quantum Security Management

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

92%EPSS

9.8Crítica

CVE-2026-91843 hace 1 mes

Stack overflow in login process to the Security Management and Log Servers

checkpoint Quantum Security Management

A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.

9.8Crítica

CVE-2026-85103 hace 1 mes

Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding

checkpoint Quantum Security Gateway; checkpoint Quantum Security Management

A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.

4.3%EPSS

9.8Crítica

CVE-2026-85102 KEV hace 1 mes

Improper Certificate Validation in Quantum Security Gateway

checkpoint Quantum Security Gateway

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

54%EPSS

9.3Crítica

CVE-2026-18574 hace 3 meses

Authentication Bypass in Check Point Security Management Server

checkpoint Security Management Server; checkpoint Multi-Domain Security Management Server

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the S…