# CVE-1999-0234: GNU Bash command separator injection via character 255

Source: https://junglewise.ai/threats/cve-1999-0234-gnu-bash-command-separator-injection-via-character-255  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 1996-10-08. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-1999-0234 · Severity: medium · CVSS 4.6 · Published 1996-10-08

The Bash command shell, a fundamental component of Linux and Unix-like operating systems, incorrectly handles a specific character (value 255) as a command separator. This flaw could allow a local user to execute unauthorized commands by tricking the system into running hidden instructions. Such an exploit could lead to unauthorized data access or system instability.

Technologies: [Gnu Bash](https://junglewise.ai/threats/technologies/bash), [Redhat Linux](https://junglewise.ai/threats/technologies/linux), [Sgi Irix](https://junglewise.ai/threats/technologies/irix). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu), [Redhat](https://junglewise.ai/threats/vendors/redhat), [Sgi](https://junglewise.ai/threats/vendors/sgi), [Suse](https://junglewise.ai/threats/vendors/suse).

## Quick answers

**Is CVE-1999-0234 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-1999-0234 being exploited in the wild.

**How severe is CVE-1999-0234?** Medium severity, with a CVSS score of 4.6, published 8 October 1996.

**Which products and versions are affected?** GNU Bash.

**Is there a fix for CVE-1999-0234?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-1999-0234 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-1999-0234?** Check whether you run Caldera Openlinux, Gnu Bash, Redhat Linux or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in GNU Bash where the character with the decimal value 255 (0xFF) is incorrectly interpreted as a command separator, similar to a semicolon or newline. This issue stems from improper input validation or character encoding handling within the shell's command parser. A local attacker could exploit this by crafting input containing this character to execute arbitrary commands with the privileges of the user running the shell. This is particularly dangerous in environments where Bash scripts process untrusted input or where the shell is used as a restricted interface. The vulnerability is addressed in later versions of Bash.

## Affected products

- GNU Bash

## Timeline

- 1996-10-08: disclosed

## References

- [https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0234](https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0234)

## Related threats

- [GNU Bash OS command injection via environment variables](https://junglewise.ai/threats/cve-2014-6278-gnu-bash-os-command-injection-via-environment-variables)
- [GNU Bash use-after-free in popd builtin](https://junglewise.ai/threats/cve-2016-9401-gnu-bash-use-after-free-in-popd-builtin)
- [GNU Bash privilege escalation via SHELLOPTS and PS4 variables](https://junglewise.ai/threats/cve-2016-7543-gnu-bash-privilege-escalation-via-shellopts-and-ps4-variables)
- [xosview 1.5.1 in Red Hat 5.1 allows local users to gain root access via a long HOME environmental variable.](https://junglewise.ai/threats/cve-1999-1490-xosview-1-5-1-in-red-hat-5-1-allows-local-users-to-gain-root)
- [Vulnerability in (1) diskperf and (2) diskalign in IRIX 6.4 allows local attacker to create arbitrary root owned…](https://junglewise.ai/threats/cve-1999-1492-vulnerability-in-1-diskperf-and-2-diskalign-in-irix-6-4-allows)