Executive brief
GNU Bash is a fundamental command-line interpreter used in almost all Linux and Unix-based systems to run scripts and manage operations. A critical vulnerability allows attackers to bypass security boundaries and execute unauthorized commands on a system by manipulating environment variables. This can lead to complete system takeover, data theft, or service disruption, especially on web servers or systems providing remote access.
Technical details
GNU Bash through version 4.3 bash43-026 fails to properly parse function definitions within environment variables. This vulnerability, part of the 'Shellshock' family, allows an attacker to execute arbitrary OS commands by passing specially crafted environment variables across a privilege boundary. Common attack vectors include OpenSSH's ForceCommand, Apache HTTP Server modules (mod_cgi/mod_cgid), and certain DHCP clients that set environment variables based on external input. This specific issue exists due to an incomplete fix for previous Bash vulnerabilities (CVE-2014-6271 and others). Patches are available from major Linux distributions and the GNU project.
Affected products
- GNU Bash through 4.3 bash43-026
Timeline
- 2014-09-30: disclosed: Initial disclosure of related Shellshock vulnerabilities
- 2025-10-02: advisory: NVD advisory publication date
- 2014-09-30: exploited: Reported as exploited in the wild shortly after discovery