#VU5327 Memory corruption in Bash - CVE-2014-7186
Published: January 24, 2017 / Updated: April 7, 2020
Vulnerability identifier: #VU5327
Vulnerability risk: Critical
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red
CVE-ID: CVE-2014-7186
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
Bash
Bash
Software vendor:
GNU
GNU
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to out-of-bounds memory access while handling multiple "<<EOF" declarations. A remote attacker can trigger memory corruption and execute arbitrary code.
Exploitation example:
bash -c 'true <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF' || echo "CVE-2014-7186 vulnerable, redir_stack"
Successful exploitation results in arbitrary code execution on the vulnerable system.
Note: this vulnerability was being actively exploited.
Remediation
Update GNU Bash to version 4.3 bash43-027.