SB2014100604 - Command injection in bash (Alpine package)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014100604

SB2014100604 - Command injection in bash (Alpine package)

Published: October 6, 2014

Security Bulletin ID SB2014100604
Severity
Critical
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Command injection (CVE-ID: CVE-2014-6278)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an incomplete fix related to the parsing of user scripts. By using attack vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, a remote attacker can execute arbitrary code with privileges of the current user. The vulnerability was introduced by incorrect patching of vulnerabilities #1 (CVE-2014-6271),  #2 (CVE-2014-7169) and #3 (CVE-2014-6277)

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited.


Remediation

Install update from vendor's website.

References