CVE-2014-7169

Impact:
Important
Public Date:
2014-09-24
IAVA:
2014-A-0142
CWE:
CWE-228
Bugzilla:
1146319: CVE-2014-7169 bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)
It was found that the fix for CVE-2014-6271 was incomplete, and Bash still allowed certain characters to be injected into other environments via specially crafted environment variables. An attacker could potentially use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue.

Find out more about CVE-2014-7169 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

Base Score 5.1
Base Metrics AV:N/AC:H/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity High
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
S-JIS for Red Hat Enteprise Linux 6 Server (bash) RHSA-2014:1312 2014-09-26
Red Hat Enterprise Linux Extended Lifecycle Support 4 (bash) RHSA-2014:1311 2014-09-26
S-JIS for Red Hat Enteprise Linux 5 Server (bash) RHSA-2014:1865 2014-11-17
Red Hat Enterprise Linux 5 (bash) RHSA-2014:1306 2014-09-26
Red Hat Enterprise Linux EUS (v. 5.9 server) (bash) RHSA-2014:1311 2014-09-26
Red Hat Enterprise Linux 6 (bash) RHSA-2014:1306 2014-09-26
RHEV-M for Servers (rhev-hypervisor6) RHSA-2014:1354 2014-10-02
Red Hat Enterprise Linux Advanced Update Support 6.2 (bash) RHSA-2014:1311 2014-09-26
Red Hat Enterprise Linux 7 (bash) RHSA-2014:1306 2014-09-26
Red Hat Enterprise Linux Extended Update Support 6.4 (bash) RHSA-2014:1311 2014-09-26
S-JIS for Red Hat Enteprise Linux 5 Server (bash) RHSA-2014:1312 2014-09-26
Red Hat Enterprise Linux Long Life (v. 5.6 server) (bash) RHSA-2014:1311 2014-09-26

Affected Packages State

Platform Package State
Red Hat Enterprise Linux 7 rhel-guest-image Affected
Red Hat Enterprise Linux 6 guest-images Affected
Red Hat Enterprise Linux 3 bash Affected
RHEV-M for Servers rhev-hypervisor Affected

Mitigation

Last Modified