Vulnerability Details : CVE-2014-6278

Public exploit exists!
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
Published 2014-09-30 10:55:05
Updated 2021-11-17 22:15:37
Source Debian GNU/Linux
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2014-6278

Probability of exploitation activity in the next 30 days: 97.35%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2014-6278

  • Apache mod_cgi Bash Environment Variable Code Injection (Shellshock)
    Disclosure Date: 2014-09-24
    First seen: 2020-04-26
    exploit/multi/http/apache_mod_cgi_bash_env_exec
    This module exploits the Shellshock vulnerability, a flaw in how the Bash shell handles external environment variables. This module targets CGI scripts in the Apache web server by setting the HTTP_USER_AGENT environment variable to a malicious function definition.
  • CUPS Filter Bash Environment Variable Code Injection (Shellshock)
    Disclosure Date: 2014-09-24
    First seen: 2020-04-26
    exploit/multi/http/cups_bash_env_exec
    This module exploits the Shellshock vulnerability, a flaw in how the Bash shell handles external environment variables. This module targets CUPS filters through the PRINTER_INFO and PRINTER_LOCATION variables. A valid username and password is required to exploit this
  • Apache mod_cgi Bash Environment Variable Injection (Shellshock) Scanner
    Disclosure Date: 2014-09-24
    First seen: 2020-04-26
    auxiliary/scanner/http/apache_mod_cgi_bash_env
    This module scans for the Shellshock vulnerability, a flaw in how the Bash shell handles external environment variables. This module targets CGI scripts in the Apache web server by setting the HTTP_USER_AGENT environment variable to a malicious function definition.

CVSS scores for CVE-2014-6278

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source
10.0
 HIGH AV:N/AC:L/Au:N/C:C/I:C/A:C
10.0
10.0
 NIST

CWE ids for CVE-2014-6278

References for CVE-2014-6278

Products affected by CVE-2014-6278

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close