CVE-2014-6277 : Chi tiết

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.

Điểm yếu liên quan

Số liệu

EPSS

Điểm EPSS

Phân vị EPSS

Thông tin khai thác

Exploit Database EDB-ID : 35081

Ngày xuất bản : 2014-10-26 23h00 +00:00
Tác giả : Michal Zalewski
EDB đã xác minh : Yes

Exploit Database EDB-ID : 36933

Ngày xuất bản : 2014-09-28 22h00 +00:00
Tác giả : fdiskyou
EDB đã xác minh : Yes

Exploit Database EDB-ID : 34860

Ngày xuất bản : 2014-10-01 22h00 +00:00
Tác giả : @0x00string
EDB đã xác minh : No

Sản phẩm được đề cập

Cấu hình 0

Gnu>>Bash >> Version 1.14.0

Gnu>>Bash >> Version 1.14.1

Gnu>>Bash >> Version 1.14.2

Gnu>>Bash >> Version 1.14.3

Gnu>>Bash >> Version 1.14.4

Gnu>>Bash >> Version 1.14.5

Gnu>>Bash >> Version 1.14.6

Gnu>>Bash >> Version 1.14.7

Gnu>>Bash >> Version 2.0

Gnu>>Bash >> Version 2.01

Gnu>>Bash >> Version 2.01.1

Gnu>>Bash >> Version 2.02

Gnu>>Bash >> Version 2.02.1

Gnu>>Bash >> Version 2.03

Gnu>>Bash >> Version 2.04

Gnu>>Bash >> Version 2.05

Gnu>>Bash >> Version 2.05

Gnu>>Bash >> Version 2.05

Gnu>>Bash >> Version 3.0

Gnu>>Bash >> Version 3.0.16

Gnu>>Bash >> Version 3.1

Gnu>>Bash >> Version 3.2

Gnu>>Bash >> Version 3.2.48

Gnu>>Bash >> Version 4.0

Gnu>>Bash >> Version 4.0

Gnu>>Bash >> Version 4.1

Gnu>>Bash >> Version 4.2

Gnu>>Bash >> Version 4.3

Tài liệu tham khảo