CVE-2014-6278GNU Bash OS Command Injection Vulnerability
Aktif olarak istismar ediliyor — GNU Bash OS Command Injection Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 02.10.2025 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 23.10.2025.
Gerekli işlem: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027 ; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23467 ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash ; https://www.ibm.com/support/pages/security-bulletin-update-vulnerabilities-bash-affect-aix-toolbox-linux-applications-cve-2014-6271-cve-2014-6277-cve-2014-6278-cve-2014-7169-cve-2014-7186-and-cve-2014-7187 ; https://nvd.nist.gov/vuln/detail/CVE-2014-6278
Açıklama
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
Kaynaklar ve yamalar
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897 Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21685749 Third Party Advisory
- HPSBMU03165 vendor-advisoryThird Party Advisory
- https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk1… Third Party Advisory
- http://linux.oracle.com/errata/ELSA-2014-3093 Third Party Advisory
- SSRT101819 vendor-advisoryThird Party Advisory
- HPSBMU03245 vendor-advisoryThird Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21686479 Third Party Advisory
- JVN#55667175 third-party-advisoryThird Party Advisory
- 60433 third-party-advisoryBroken Link
- HPSBMU03143 vendor-advisoryThird Party Advisory
- HPSBMU03182 vendor-advisoryThird Party Advisory
- http://packetstormsecurity.com/files/137344/Sun-Secure-Global-Desktop-Oracle-Global-Desktop-Shellshock.html Third Party Advisory
- HPSBST03155 vendor-advisoryThird Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21685541 Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html Third Party Advisory
- 61816 third-party-advisoryBroken Link
- openSUSE-SU-2014:1310 vendor-advisoryMailing List
- 61442 third-party-advisoryBroken Link
- HPSBMU03246 vendor-advisoryThird Party Advisory
- 61283 third-party-advisoryBroken Link
- https://kc.mcafee.com/corporate/index?page=content&id=SB10085 Third Party Advisory
- 61654 third-party-advisoryBroken Link
- USN-2380-1 vendor-advisoryThird Party Advisory
- http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315 Third Party Advisory
- 62312 third-party-advisoryBroken Link
- https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html Third Party Advisory
- HPSBMU03217 vendor-advisoryThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2014-6278 Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21685604 Third Party Advisory
- SSRT101868 vendor-advisoryThird Party Advisory
- 61703 third-party-advisoryBroken Link
- 61065 third-party-advisoryBroken Link
- HPSBST03129 vendor-advisoryThird Party Advisory
- HPSBMU03144 vendor-advisoryThird Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21686445 Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21686131 Third Party Advisory
- JVNDB-2014-000126 third-party-advisoryThird Party Advisory
- 61641 third-party-advisoryBroken Link
- 39887 exploitThird Party Advisory
- https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648 Third Party Advisory
- SUSE-SU-2014:1287 vendor-advisoryMailing List
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898 Third Party Advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21685914 Third Party Advisory
- MDVSA-2015:164 vendor-advisoryThird Party Advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04497075 Third Party Advisory
- 60325 third-party-advisoryBroken Link
- 60024 third-party-advisoryBroken Link
- http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html Third Party Advisory
- http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html Third Party Advisory
- 20140926 GNU Bash Environment Variable Command Injection Vulnerability vendor-advisoryThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1147414 Third Party Advisory
- 62343 third-party-advisoryThird Party Advisory
- 61565 third-party-advisoryBroken Link
- https://www.suse.com/support/shellshock/ Vendor Advisory
- HPSBST03157 vendor-advisoryThird Party Advisory
- 61313 third-party-advisoryBroken Link
- 61485 third-party-advisoryBroken Link
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04518183 Third Party Advisory
- HPSBST03154 vendor-advisoryThird Party Advisory
CPE eşleşmeleri (NVD) (28)
cpe:2.3:a:gnu:bash:1.14.0:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:1.14.1:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:1.14.2:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:1.14.3:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:1.14.4:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:1.14.5:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:1.14.6:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:1.14.7:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:2.0:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:2.01:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:2.01.1:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:2.02:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:2.02.1:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:2.03:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:2.04:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:2.05:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:2.05:a:*:*:*:*:*:*cpe:2.3:a:gnu:bash:2.05:b:*:*:*:*:*:*cpe:2.3:a:gnu:bash:3.0:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:3.0.16:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:3.1:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:3.2:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:3.2.48:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:4.0:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:4.0:rc1:*:*:*:*:*:*cpe:2.3:a:gnu:bash:4.1:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:4.2:*:*:*:*:*:*:*cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:*