CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-01-28
EPSS: 99.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-09-25 · updated 2026-06-17
Weakness: CWE-78

Description

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

Affected products

macOS: from 10.0.0 before 10.10.0 — fixed in 10.10.0
Arista Networks EOS: from 4.9.0 before 4.9.12; from 4.10.0 before 4.10.9; from 4.11.0 before 4.11.11; from 4.12.0 before 4.12.9; from 4.13.0 before 4.13.9; from 4.14.0 before 4.14.4f — fixed in 4.9.12, 4.10.9, 4.11.11, 4.12.9, 4.13.9, 4.14.4f
Canonical Ubuntu Linux: 10.04, 12.04, 14.04 (and their updates)
Check Point Security Gateway: before r77.30 — fixed in r77.30
Citrix Netscaler Sdx Firmware: before 9.3.67.5r1; from 10 before 10.1.129.11r1; from 10.5 before 10.5.52.11r1 — fixed in 9.3.67.5r1, 10.1.129.11r1, 10.5.52.11r1
Debian Linux: 7.0 (and their updates)
F5 Arx Firmware: from 6.0.0 through 6.4.0
F5 BIG-IP APM: from 10.1.0 through 10.2.4; from 11.0.0 through 11.5.1; 11.6.0 (and their updates)
BIG-IP: from 11.3.0 through 11.5.1; 11.6.0 (and their updates)
F5 Big-Ip Analytics: from 11.0.0 through 11.5.1; 11.6.0 (and their updates)
F5 Networks, Inc. BIG-IP (AAM): from 11.4.0 through 11.5.1; 11.6.0 (and their updates)
BIG-IP ASM: from 10.0.0 through 10.2.4; from 11.0.0 through 11.5.1; 11.6.0 (and their updates)
F5 Big-Ip Edge Gateway: from 10.1.0 through 10.2.4; from 11.0.0 through 11.3.0
F5 Big-Ip Global Traffic Manager: from 10.0.0 through 10.2.4; from 11.0.0 through 11.5.1; 11.6.0 (and their updates)
F5 Big-Ip Link Controller: from 10.0.0 through 10.2.4; from 11.0.0 through 11.5.1; 11.6.0 (and their updates)
F5 BIG-IP (LTM): from 10.0.0 through 10.2.4; from 11.0.0 through 11.5.1; 11.6.0 (and their updates)
F5 Networks, Inc. BIG-IP (PEM): from 11.3.0 through 11.5.1; 11.6.0 (and their updates)
F5 Big-Ip Protocol Security Module: from 10.0.0 through 10.2.4; from 11.0.0 through 11.4.1
F5 Big-Ip Wan Optimization Manager: from 10.0.0 through 10.2.4; from 11.0.0 through 11.3.0
F5 Big-Ip Webaccelerator: from 10.0.0 through 10.2.4; from 11.0.0 through 11.3.0
F5 Big-Iq Cloud: from 4.0.0 through 4.4.0
F5 Big-Iq Device: from 4.2.0 through 4.4.0
F5 Big-Iq Security: from 4.0.0 through 4.4.0
F5 Networks, Inc. Enterprise Manager: from 2.1.0 through 2.3.0; from 3.0.0 through 3.1.1
F5 Traffix SDC: from 4.0.0 through 4.0.5; 3.3.2, 3.4.1, 3.5.1, 4.1.0 (and their updates)
GNU Bash: through 4.3
IBM Flex System V7000 Firmware: from 1.1.0.0 before 7.1.0.11; from 7.2.0.0 before 7.2.0.9; from 7.3.0.0 before 7.3.0.7 — fixed in 7.1.0.11, 7.2.0.9, 7.3.0.7
IBM Infosphere Guardium Database Activity Monitoring: 8.2, 9.0, 9.1 (and their updates)
IBM PureApplication System: from 1.0.0.0 through 1.0.0.4; from 1.1.0.0 through 1.1.0.4; 2.0.0.0 (and their updates)
IBM Qradar Risk Manager: 7.1.0 (and their updates)

How to fix

Upgrade to a fixed version: macOS 10.10.0; Arista Networks EOS 4.9.12, 4.10.9, 4.11.11, 4.12.9; Check Point Security Gateway r77.30; Citrix Netscaler Sdx Firmware 9.3.67.5r1, 10.1.129.11r1, 10.5.52.11r1; IBM Flex System V7000 Firmware 7.1.0.11, 7.2.0.9, 7.3.0.7; IBM San Volume Controller Firmware 7.1.0.11, 7.2.0.9, 7.3.0.7; IBM Software Defined Network For Virtual Environments 1.2.1; IBM Stn6500 Firmware 3.8.0.07, 3.9.1.08, 4.1.2.06; IBM Stn6800 Firmware 3.8.0.07, 3.9.1.08, 4.1.2.06; IBM Stn7800 Firmware 3.8.0.07, 3.9.1.08, 4.1.2.06; IBM Storwize V3500 Firmware 7.1.0.11, 7.2.0.9, 7.3.0.7; IBM Storwize V3700 Firmware 7.1.0.11, 7.2.0.9, 7.3.0.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2014-7169 or the next vulnerability affects your stack