CVE-2014-7169

原文の説明

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

影響を受けるソフトウェア

• Bash ≤ 4.3 完全一致

詳細

公開日

2014-09-25

最終更新

2026-06-17

CVSS ベクター

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-78

EPSS（30日以内の悪用確率）

99.94% (パーセンタイル 100)

参考資料

• cve.org/CVE-2014-7169
• nvd.nist.gov/vuln/detail/CVE-2014-7169
• advisories.mageia.org/MGASA-2014-0393.html
• archives.neohapsis.com/archives/bugtraq/2014-10/0101.html
• jvn.jp/en/jp/JVN55667175/index.html
• jvndb.jvn.jp/jvndb/JVNDB-2014-000126
• lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html
• linux.oracle.com/errata/ELSA-2014-1306.html
• linux.oracle.com/errata/ELSA-2014-3075.html
• linux.oracle.com/errata/ELSA-2014-3077.html
• linux.oracle.com/errata/ELSA-2014-3078.html
• lists.opensuse.org/opensuse-security-announce/2014-09/msg00038.html
• lists.opensuse.org/opensuse-security-announce/2014-09/msg00041.html
• lists.opensuse.org/opensuse-security-announce/2014-09/msg00042.html