Loading vulnerability…
Shellshock
Shellshock (CVE-2014-6271) is an OS command injection vulnerability in unpatched GNU Bash versions through 4.3. When importing function definitions from environment variables, Bash incorrectly processes and executes trailing commands following the function definition. Attackers who can influence environment variables passed to a vulnerable Bash process can execute arbitrary commands across a trust or privilege boundary. Exposure includes Apache HTTP Server CGI execution through mod_cgi or mod_cgid, certain OpenSSH ForceCommand configurations, and scripts invoked by some DHCP clients. The initial fix was incomplete; CVE-2014-7169 identifies a related vulnerability remaining after that fix.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation executes arbitrary commands with the privileges of the application invoking Bash, potentially compromising confidentiality, integrity, and availability. Depending on those privileges and accessible resources, attackers can steal or modify data, install malware, disrupt services, and use the compromised host for further intrusion. Internet-facing services can expose unauthenticated remote exploitation. Shellshock has been exploited in the wild, including to install Gafgyt botnet malware.
If you can’t patch tonight, do this now.
Until updates can be applied, disable exposed CGI scripts that invoke Bash and restrict access to other services that pass attacker-controlled environment variables to Bash. Prevent untrusted environment values from reaching vulnerable Bash processes where feasible. Use network access controls and segmentation to reduce exposure and contain compromise, and monitor for exploitation attempts. These controls do not replace patching.
Patch, then assume compromise.
Install current vendor-supported Bash updates addressing CVE-2014-6271 and the related Shellshock vulnerabilities, including CVE-2014-7169, CVE-2014-6277, CVE-2014-6278, CVE-2014-7186, and CVE-2014-7187. Do not rely solely on the initial CVE-2014-6271 patch. Update affected operating systems, appliances, and bundled Bash packages through their respective vendors, and validate patch effectiveness using published vendor or CERT test cases.
30 exploits validated by Mallory's analysis. Hidden: 21 rejected by Mallory's analysis as not a working exploit; 18 not yet analyzed, such as Exploit-DB entries. Showing the 25 most capable, earliest first.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
75 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.