Vulnerability record · CVE-2014-6277 · published 27 September 2014
CVE-2014-6277: GNU Bash environment function parsing flaw allows command execution
Gnu · Bash
GNU Bash through 4.3 bash43-026 fails to properly parse function definitions in environment variable values, allowing crafted environments to trigger uninitialized memory access and untrusted pointer reads and writes. It is an incomplete fix for CVE-2014-6271 and CVE-2014-7169, so systems patched only for those earlier flaws remain exposed.
Description
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
high priorityNetwork-reachable, unauthenticated code execution with a very high EPSS score and public exploit references, though it is not in KEV and requires an environment-setting vector.
What it is
GNU Bash through 4.3 bash43-026 fails to properly parse function definitions in environment variable values, allowing crafted environments to trigger uninitialized memory access and untrusted pointer reads and writes. It is an incomplete fix for CVE-2014-6271 and CVE-2014-7169, so systems patched only for those earlier flaws remain exposed.
Impact
An attacker can execute arbitrary code or cause a denial of service in the context of the process that invokes Bash across a privilege boundary.
Attack surface
Reached remotely over the network with no authentication and no user interaction (AV:N/AC:L/Au:N), through vectors such as OpenSSH ForceCommand, Apache mod_cgi/mod_cgid, DHCP client scripts, and any path where the environment is set across a privilege boundary before Bash runs.
Exploitation
Not listed in CISA KEV, but EPSS is 0.64326 (99.194th percentile), and a reference is tagged Exploit and Patch, indicating public exploit material exists.
What to do
- Patch Bash to a version that fully addresses CVE-2014-6277 and the earlier CVE-2014-6271/CVE-2014-7169 fixes; verify the distribution's updated package rather than relying on the initial Shellshock patch.
- Apply vendor errata for all affected platforms (Oracle ELSA-2014-3093/3094, openSUSE, Apple) and re-check any system patched only in September 2014.
- Reduce exposure by disabling or restricting CGI on Apache where not required and limiting ForceCommand use in sshd.
- Sanitize or strip function definitions from environment variables passed across privilege boundaries (for example via sudo, sshd, or CGI) until patching is complete.
Detection
- Monitor for Bash processes spawned from CGI, sshd ForceCommand, or DHCP scripts with unusual environment contents or unexpected child processes.
- Alert on outbound network connections or shell execution originating from web server and SSH service accounts.
- Audit installed Bash package versions against vendor fixed releases and flag hosts still running pre-fix builds.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-6277 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-6277), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
