{"id":"CVE-2014-6278","url":"https://www.cyber-defence.io/tools/cve/CVE-2014-6278","generatedAt":"2026-10-31T22:35:17.029Z","title":"GNU Bash OS Command Injection Vulnerability","description":"GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.","published":"2014-09-30T10:55:05.000Z","lastModified":"2026-06-17T00:12:50.000Z","status":"Analyzed","sourceIdentifier":"security@debian.org","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-78"],"affected":["gnu/bash"],"epss":{"score":0.99669,"percentile":0.9995,"date":"2026-10-30","history":[]},"kev":{"listed":true,"dateAdded":"2025-10-02","dueDate":"2025-10-23","knownRansomwareCampaignUse":"Unknown","notes":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. \nThis vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027 ; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23467 ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash ; https://www.ibm.com/support/pages/security-bulletin-update-vulnerabilities-bash-affect-aix-toolbox-linux-applications-cve-2014-6271-cve-2014-6277-cve-2014-6278-cve-2014-7169-cve-2014-7186-and-cve-2014-7187 ; https://nvd.nist.gov/vuln/detail/CVE-2014-6278"},"exploits":{"count":5,"verified":true,"firstPublished":"2014-09-29","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":39887,"kind":"exploit","title":"Sun Secure Global Desktop and Oracle Global Desktop 4.61.915 - Command Injection (Shellshock)","url":"https://www.exploit-db.com/exploits/39887","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/cgi/webapps/39887.txt","file":"exploits/cgi/webapps/39887.txt","published":"2016-06-06","added":"2016-06-06","updated":"2017-11-15","author":"lastc0de","type":"webapps","platform":"cgi","port":80,"verified":false,"codes":["CVE-2014-6278"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":39568,"kind":"exploit","title":"Cisco UCS Manager 2.1(1b) - Remote Command Injection (Shellshock)","url":"https://www.exploit-db.com/exploits/39568","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/hardware/remote/39568.py","file":"exploits/hardware/remote/39568.py","published":"2016-03-16","added":"2016-03-16","updated":"2017-11-15","author":"thatchriseckert","type":"remote","platform":"hardware","port":443,"verified":false,"codes":["CVE-2014-6278"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash"},{"edbId":34900,"kind":"exploit","title":"Apache mod_cgi - 'Shellshock' Remote Command Injection","url":"https://www.exploit-db.com/exploits/34900","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/34900.py","file":"exploits/linux/remote/34900.py","published":"2014-10-06","added":"2014-10-06","updated":"2018-01-22","author":"Federico Galatolo","type":"remote","platform":"linux","port":null,"verified":true,"codes":["CVE-2014-6278","CVE-2014-6271"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":34860,"kind":"exploit","title":"GNU bash 4.3.11 - Environment Variable dhclient","url":"https://www.exploit-db.com/exploits/34860","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/34860.py","file":"exploits/linux/remote/34860.py","published":"2014-10-02","added":"2014-10-02","updated":"2014-10-02","author":"@0x00string","type":"remote","platform":"linux","port":null,"verified":false,"codes":["CVE-2014-7910","OSVDB-112169","CVE-2014-7227","CVE-2014-7196","CVE-2014-7187","CVE-2014-7186","CVE-2014-7169","CVE-2014-6278","CVE-2014-62771","OSVDB-112158","OSVDB-112097","OSVDB-112096","OSVDB-112004","CVE-2014-6277","CVE-2014-6271","CVE-2014-3671","CVE-2014-3659"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":36933,"kind":"exploit","title":"dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock)","url":"https://www.exploit-db.com/exploits/36933","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/36933.py","file":"exploits/linux/remote/36933.py","published":"2014-09-29","added":"2014-09-29","updated":"2017-11-15","author":"fdiskyou","type":"remote","platform":"linux","port":null,"verified":true,"codes":["CVE-2014-7187","CVE-2014-7186","CVE-2014-7169","CVE-2014-6278","CVE-2014-6277"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 23 October 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://jvn.jp/en/jp/JVN55667175/index.html","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html","tags":["Patch","Third Party Advisory"],"source":"security@debian.org"},{"url":"http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://linux.oracle.com/errata/ELSA-2014-3093","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://linux.oracle.com/errata/ELSA-2014-3094","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00004.html","tags":["Mailing List"],"source":"security@debian.org"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.html","tags":["Mailing List"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141330468527613&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141345648114150&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141383026420882&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141383081521087&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141383196021590&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141383244821813&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141383304022067&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141383353622268&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141383465822787&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141450491804793&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141576728022234&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141577137423233&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141577241923505&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141577297623641&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141585637922673&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=141879528318582&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=142118135300698&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=142358026505815&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=142358078406056&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://marc.info/?l=bugtraq&m=142721162228379&w=2","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://packetstormsecurity.com/files/137344/Sun-Secure-Global-Desktop-Oracle-Global-Desktop-Shellshock.html","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/58200","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/59907","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/59961","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/60024","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/60034","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/60044","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/60055","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/60063","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/60193","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/60325","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/60433","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61065","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61128","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61129","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61283","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61287","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61291","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61312","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61313","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61328","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61442","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61471","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61485","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61503","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61550","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61552","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61565","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61603","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61633","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/61641","tags":["Broken Link"],"source":"security@debian.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-6278","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}