logo

Database

Lack of data validation - Path Traversal In bash

Description

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2014-71692. NVD-2014-71693. OSV-DEBIAN-2014-71694. OSV-2014-71695. SECURITY-TRACKER-CVE-2014-7169

References

1. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-71692. https://www.exploit-db.com/exploits/347773. https://www.exploit-db.com/exploits/348954. https://www.exploit-db.com/exploits/348395. https://www.exploit-db.com/exploits/347666. https://www.exploit-db.com/exploits/351157. https://www.exploit-db.com/exploits/369338. https://www.exploit-db.com/exploits/347659. https://www.exploit-db.com/exploits/3489610. https://www.exploit-db.com/exploits/3486211. https://github.com/chef-boneyard/bash-shellshock

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.