Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2014-6271

Quick assessment

Affected
n/a n/a
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GNU Bash是美国软件开发者布莱恩-福克斯（Brian J. Fox）为GNU计划而编写的一个Shell（命令语言解释器），它运行于类Unix操作系统中（Linux系统的默认Shell），并能够从标准输入设备或文件中读取、执行命令，同时也结合了一部分ksh和csh的特点。 GNU Bash 4.3及之前版本中存在安全漏洞，该漏洞源于程序没有正确处理环境变量值内的函数定义。远程攻击者可借助特制的环境变量利用该漏洞执行任意代码。以下产品和模块可能会被利用：OpenSSH sshd中的ForceComman

AI Predicted 10.0 Difficulty: Trivial KEV EPSS 100.00% · P100
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2014-6271

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
GNU Bash 远程代码执行漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GNU Bash是美国软件开发者布莱恩-福克斯（Brian J. Fox）为GNU计划而编写的一个Shell（命令语言解释器），它运行于类Unix操作系统中（Linux系统的默认Shell），并能够从标准输入设备或文件中读取、执行命令，同时也结合了一部分ksh和csh的特点。 GNU Bash 4.3及之前版本中存在安全漏洞，该漏洞源于程序没有正确处理环境变量值内的函数定义。远程攻击者可借助特制的环境变量利用该漏洞执行任意代码。以下产品和模块可能会被利用：OpenSSH sshd中的ForceComman
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2014-6271

# POC Description Source Link Shenlong Link
1 Collected fixes for bash CVE-2014-6271 https://github.com/dlitz/bash-cve-2014-6271-fixes POC Details
2 Patch for CVE-2014-6271 https://github.com/npm/ansible-bashpocalypse POC Details
3 patched-bash-4.3 for CVE-2014-6271 https://github.com/ryancnelson/patched-bash-4.3 POC Details
4 Chef cookbook that will fail if bash vulnerability found per CVE-2014-6271 https://github.com/jblaine/cookbook-bash-CVE-2014-6271 POC Details
5 None https://github.com/rrreeeyyy/cve-2014-6271-spec POC Details
6 Python Scanner for "ShellShock" (CVE-2014-6271) https://github.com/scottjpack/shellshock_scanner POC Details
7 Written fro CVE-2014-6271 https://github.com/Anklebiter87/Cgi-bin_bash_Reverse POC Details
8 a auto script to fix CVE-2014-6271 bash vulnerability https://github.com/justzx2011/bash-up POC Details
9 None https://github.com/mattclegg/CVE-2014-6271 POC Details
10 Quick and dirty nessus .audit file to check is bash is vulnerable to CVE-2014-6271 https://github.com/ilismal/Nessus_CVE-2014-6271_check POC Details
11 CVE-2014-6271 RCE tool https://github.com/RainMak3r/Rainstorm POC Details
12 Simple script to check for CVE-2014-6271 https://github.com/gabemarshall/shocknaww POC Details
13 None https://github.com/woltage/CVE-2014-6271 POC Details
14 CVE-2014-6271の検証用Vagrantfileです https://github.com/ariarijp/vagrant-shellshock POC Details
15 scripts associate with bourne shell EVN function parsing vulnerability CVE-2014-6271 https://github.com/themson/shellshock POC Details
16 CVE-2014-6271 (ShellShock) RCE PoC tool https://github.com/securusglobal/BadBash POC Details
17 scaner for cve-2014-6271 https://github.com/villadora/CVE-2014-6271 POC Details
18 Salt recipe for shellshock (CVE-2014-6271) https://github.com/APSL/salt-shellshock POC Details
19 Ansible role to check the CVE-2014-6271 vulnerability https://github.com/teedeedubya/bash-fix-exploit POC Details
20 Debian Lenny Bash packages with cve-2014-6271 patches (i386 and amd64) https://github.com/internero/debian-lenny-bash_3.2.52-cve-2014-6271 POC Details
21 None https://github.com/u20024804/bash-3.2-fixed-CVE-2014-6271 POC Details
22 None https://github.com/u20024804/bash-4.2-fixed-CVE-2014-6271 POC Details
23 None https://github.com/u20024804/bash-4.3-fixed-CVE-2014-6271 POC Details
24 A python script to enumerate CGI scripts vulnerable to CVE-2014-6271 on one specific server https://github.com/francisck/shellshock-cgi POC Details
25 A script, in C, to check if CGI scripts are vulnerable to CVE-2014-6271 (The Bash Bug) https://github.com/proclnas/ShellShock-CGI-Scan POC Details
26 CVE-2014-6271 Remote Interactive Shell - PoC Exploit https://github.com/sch3m4/RIS POC Details
27 None https://github.com/ryeyao/CVE-2014-6271_Test POC Details
28 shellshock CVE-2014-6271 CGI Exploit, Use like Openssh via CGI https://github.com/cj1324/CGIShell POC Details
29 This module determine the vulnerability of a bash binary to the shellshock exploits (CVE-2014-6271 or CVE-2014-7169) and then patch that where possible https://github.com/renanvicente/puppet-shellshock POC Details
30 Android app to scan for bash Vulnerability - CVE-2014-6271 also known as Shellshock https://github.com/indiandragon/Shellshock-Vulnerability-Scan POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2014-6271

请登录查看更多情报信息。

Vendor Advisories for CVE-2014-6271 (93)

Exploits & Public PoCs for CVE-2014-6271 (10)

Mailing List Discussions for CVE-2014-6271 (39)

Security Blog Posts for CVE-2014-6271 (1)

Other References for CVE-2014-6271 (18)

Same Patch Batch · n/a · 2014-09-24 · 12 CVEs total

CVE-2014-6693 Android Juiker应用程序加密问题漏洞
CVE-2014-6694 Android 5SOS Family Planet应用程序加密问题漏洞
CVE-2014-6695 Android Wedding Photo Frames-Love Pics应用程序加密问题漏洞
CVE-2014-6696 Android Candy Girl Party Makeover应用程序加密问题漏洞
CVE-2014-6697 Android Morocco Weather应用程序加密问题漏洞
CVE-2014-6698 Android Galaxy Online 2应用程序加密问题漏洞
CVE-2014-6699 Android Weather Channel应用程序加密问题漏洞
CVE-2014-6700 Android NBA Game Time 2013-2014应用程序加密问题漏洞
CVE-2014-6701 Android Vendormate Mobile应用程序加密问题漏洞
CVE-2014-3380 Cisco Unified Communications Domain Manager Platform Software 安全漏洞
CVE-2014-5323 Android Yuko Yuko应用程序加密问题漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2014-6271

No comments yet

Leave a comment