Command injection in Bash - CVE-2014-7169

Vulnerability identifier: #VU5294

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-7169

CWE-ID: CWE-77

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The weakness exists due to an incomplete fix related to malformed function definitions in the values of environment variables. By using multiple attack vectors (DHCP, HTTP, SIP, FTP, and SMTP) involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, a remote attacker can inject and execute arbitrary commands.This vulnerability exists due to incomplete fix for vulnerability #1 (CVE-2014-6271).

Exploitation example:

env X='() { (a)=>\' bash -c "echo date"; cat echo

Successful exploitation may allow an attacker to gain complete control over vulnerable system.

Note: this vulnerability was being actively exploited.

Bash
ProtecTIER Entry Edition (PID 5639-PTC) - TS7610 / TS7620
ProtecTIER Appliance Edition (PID 5639-PTB) - TS7650AP1
ProtecTIER Enterprise Edition (PID 5639-PTA) - TS7650G
StoreEver ESL G3 Tape Library
HP Enterprise Maps
Helion Public Cloud
Virtualization Performance Viewer
Automation Insight
TippingPoint Next Generation Firewall
Operations Analytics
HP Business Service Automation Essentials
Operations Agent Virtual Appliance
FlashSystem V840 9846-AE1 & 9848-AE1
FlashSystem 840 9840-AE1 & 9843-AE1
Hyper-Scale Manager
StoreOnce Gen 2 Backup
Integrity SD2 CB900s i4 & i2
3PAR Service Processors
NonStop Virtual TapeServer (VTS)
FlashSystem V840 9846-AC0 & -AC1 and 9848-AC0 & -AC1
Virtual Customer Access System (vCAS)
Amazon Linux AMI
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux EUS Compute Node
SUSE Linux
Ubuntu
Slackware Linux
Fedora
StoreAll OS
bash (Alpine package)
bash
FOS Firmware
IBM Storwize V5000
IBM Storwize V3700
IBM Storwize V7000
IBM Storwize V3500

Update GNU Bash to version 4.3 bash43-027.

TippingPoint Next Generation Firewall - update to 1.1.0.4153
bash (Alpine package) - update to 4.2.050-r0
FlashSystem V840 9846-AE1 & 9848-AE1 - update to 1.1.2.7
FlashSystem 840 9840-AE1 & 9843-AE1 - update to 1.1.2.7
Hyper-Scale Manager - update to 1.5.0.59
StoreOnce Gen 2 Backup - update to 2.3.02
Integrity SD2 CB900s i4 & i2 - update to 3.8.0
3PAR Service Processors - addressed in versions 4.1.0.GA-97.P011, 4.2.0.GA-29.P003, 4.3.0.GA-17.P001
bash - addressed in versions 4.3.22-3.fc21, 4.3.25-2.fc21
FOS Firmware - addressed in versions 6.2.2f9, 6.4.2a3, 6.4.3f3, 7.0.0d1, 7.0.2e1, 7.1.0cb, 7.1.1c1, 7.1.2b1, 7.2.0d6, 7.2.1c1
StoreAll OS - addressed in versions 6.3.4, 6.5.5
NonStop Virtual TapeServer (VTS) - addressed in versions 6.04.05, 8.3, 8.4
IBM Storwize V5000 - addressed in versions 7.1.0.11, 7.2.0.9, 7.3.0.7
IBM Storwize V3700 - addressed in versions 7.1.0.11, 7.2.0.9, 7.3.0.7
IBM Storwize V7000 - addressed in versions 7.1.0.11, 7.2.0.9
IBM Storwize V3500 - addressed in versions 7.1.0.11, 7.2.0.9, 7.3.0.7
FlashSystem V840 9846-AC0 & -AC1 and 9848-AC0 & -AC1 - update to 7.3.0.7
Virtual Customer Access System (vCAS) - update to 14.10-38402

• Exploit #2374 - exploit-CVE-2014-6271 (Shellshock exploit + vulnerable environment) (April 7, 2020)
• Exploit #865 - CUPS Filter - Bash Environment Variable Code Injection (Metasploit) (March 18, 2020)
• Exploit #872 - GNU Bash - Environment Variable Command Injection (Shellshock) (March 18, 2020)
• Exploit #871 - Bash - Environment Variables Code Injection (Shellshock) (March 18, 2020)
• Exploit #870 - GNU Bash - Environment Variable Command Injection (Metasploit) (March 18, 2020)
• Exploit #869 - GNU bash 4.3.11 - Environment Variable dhclient Exploit (March 18, 2020)
• Exploit #868 - Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit) (March 18, 2020)
• Exploit #867 - OpenVPN 2.2.29 - Remote Exploit (Shellshock) (March 18, 2020)
• Exploit #866 - Postfix SMTP 4.2.x < 4.2.48 - Remote Exploit (Shellshock) (March 18, 2020)
• Exploit #119 - puppet-shellshock (This module determine the vulnerability of a bash binary to the shellshock exploits (CVE-2014-6271 or CVE-2014-7169) and then patch that where possible) (March 18, 2020)
• Exploit #864 - QNAP - Admin Shell via Bash Environment Variable Code Injection (Metasploit) (March 18, 2020)
• Exploit #863 - QNAP - Web Server Remote Code Execution via Bash Environment Variable Code Injection (Metasploit) (March 18, 2020)
• Exploit #862 - dhclient 4.1 - Bash Environment Variable Command Injection (PoC) (Shellshock) (March 18, 2020)
• Exploit #861 - IPFire - Cgi Web Interface Authenticated Bash Environment Variable Code Injection (March 18, 2020)
• Exploit #860 - Bash CGI - Remote Code Execution (Shellshock) (Metasploit) (March 18, 2020)
• Exploit #859 - PHP < 5.6.2 - Bypass disable_functions Exploit (Shellshock) (March 18, 2020)
• Exploit #858 - Kemp Load Master 7.1.16 - Multiple Vulnerabilities (March 18, 2020)

• https://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027

• Multiple RCE vulnerabilities in GNU Bash aka Shellshock
• Ubuntu update for Bash
• Ubuntu update for Bash
• Debian update for bash
• Gentoo update for Bash
• [slackware-security] bash (rebuild for Slackware 13.0 only)
• Slackware Linux update for bash
• openSUSE update for bash
• SUSE Linux update for bash
• openSUSE update for bash
• SUSE Linux update for bash
• openSUSE update for bash
• openSUSE update for bash
• SUSE Linux update for Containment-Studio
• openSUSE update for Shellshock
• Amazon Linux AMI update for bash
• Red Hat update for bash
• Command injection in bash (Alpine package)
• Multiple vulnerabilities in IBM FlashSystem 840 and V840
• Multiple vulnerabilities in IBM FOS Firmware
• Multiple vulnerabilities in HP Remote Device Access: Virtual Customer Access System (vCAS)
• Multiple vulnerabilities in HP Automation Insight
• Multiple vulnerabilities in HP Business Service Automation Essentials
• Multiple vulnerabilities in HP Operations Analytics
• Multiple vulnerabilities in HP Next Generation Firewall (NGFW)
• Multiple vulnerabilities in HP Integrity SD2 CB900s i4 & i2
• Multiple vulnerabilities in HP Operation Agent Virtual Appliance
• Multiple vulnerabilities in HP Virtualization Performance Viewer
• Multiple vulnerabilities in HP Helion Public Cloud
• Multiple vulnerabilities in HP Enterprise Maps Virtual Appliance
• Multiple vulnerabilities in HP NonStop Virtual TapeServer (VTS)
• Multiple vulnerabilities in HP 3PAR Service Processor (SP)
• Multiple vulnerabilities in HP StoreOnce Gen 2 Backup
• Multiple vulnerabilities in HP StoreEver ESL G3 Tape Library
• Multiple vulnerabilities in HP StoreAll Operating System
• Multiple vulnerabilities in SAN Volume Controller and Storwize Family
• Multiple vulnerabilities in IBM ProtecTIER
• Multiple vulnerabilities in IBM Hyper-Scale Manager
• Fedora 21 update for bash
• Fedora 21 update for bash