ID:894 - Exploit for Memory corruption in Bash - CVE-2014-6277

Link to public exploit:

Vulnerability description

The vulnerability exists due to incorrect parsing of environment variables. A remote attacker can trigger memory corruption and execute arbitrary code on the target system as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. The vulnerability was introduced by incorrect patching of vulnerabilities #1 (CVE-2014-6271) and #2 (CVE-2014-7169).

Successful exploitation results in arbitrary code execution on the vulnerable system.

Note: this vulnerability was being actively exploited in the wild.

Remediation