Command injection in Bash - CVE-2014-6278
Published: January 24, 2017 / Updated: October 2, 2025
Vulnerability identifier: #VU5322
CSH Severity: Critical
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red
CVE-ID: CVE-2014-6278
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vendor: GNU
Affected software:
Bash
Bash
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to an incomplete fix related to the parsing of user scripts. By using attack vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, a remote attacker can execute arbitrary code with privileges of the current user. The vulnerability was introduced by incorrect patching of vulnerabilities #1 (CVE-2014-6271), #2 (CVE-2014-7169) and #3 (CVE-2014-6277)
Successful exploitation results in arbitrary code execution on the vulnerable system.
Note: this vulnerability was being actively exploited.
How to mitigate CVE-2014-6278
Update GNU Bash to version 4.3 bash43-027.