Exploited
critical
10
CWE
78
Advisory Published
CVE Published
Updated

CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

First published: Mon Sep 15 2014(Updated: )

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.

Credit: security@debian.org security@debian.org

Affected SoftwareAffected VersionHow to fix
GNU Bash=1.14.0
GNU Bash=1.14.1
GNU Bash=1.14.2
GNU Bash=1.14.3
GNU Bash=1.14.4
GNU Bash=1.14.5
GNU Bash=1.14.6
GNU Bash=1.14.7
GNU Bash=2.0
GNU Bash=2.01
GNU Bash=2.01.1
GNU Bash=2.02
GNU Bash=2.02.1
GNU Bash=2.03
GNU Bash=2.04
GNU Bash=2.05
GNU Bash=2.05-a
GNU Bash=2.05-b
GNU Bash=3.0
GNU Bash=3.0.16
GNU Bash=3.1
GNU Bash=3.2
GNU Bash=3.2.48
GNU Bash=4.0
GNU Bash=4.0-rc1
GNU Bash=4.1
GNU Bash=4.2
GNU Bash=4.3
GNU Bash
GNU Bash<=4.3
Arista EOS>=4.9.0<4.9.12
Arista EOS>=4.10.0<4.10.9
Arista EOS>=4.11.0<4.11.11
Arista EOS>=4.12.0<4.12.9
Arista EOS>=4.13.0<4.13.9
Arista EOS>=4.14.0<4.14.4f
Oracle Linux=4
Oracle Linux=5
Oracle Linux=6
QNAP QTS<4.1.1
QNAP QTS=4.1.1
QNAP QTS=4.1.1-build_0927
Mageia=3.0
Mageia=4.0
Red Hat Gluster Storage Server=2.1
Red Hat Enterprise Virtualization=3.4
Red Hat Enterprise Linux=4.0
Red Hat Enterprise Linux=5.0
Red Hat Enterprise Linux=6.0
Red Hat Enterprise Linux=7.0
redhat enterprise Linux desktop=5.0
redhat enterprise Linux desktop=6.0
redhat enterprise Linux desktop=7.0
redhat enterprise Linux eus=5.9
redhat enterprise Linux eus=6.4
redhat enterprise Linux eus=6.5
redhat enterprise Linux eus=7.3
redhat enterprise Linux eus=7.4
redhat enterprise Linux eus=7.5
redhat enterprise Linux eus=7.6
redhat enterprise Linux eus=7.7
redhat enterprise Linux for ibm z systems=5.9_s390x
redhat enterprise Linux for ibm z systems=6.4_s390x
redhat enterprise Linux for ibm z systems=6.5_s390x
redhat enterprise Linux for ibm z systems=7.3_s390x
redhat enterprise Linux for ibm z systems=7.4_s390x
redhat enterprise Linux for ibm z systems=7.5_s390x
redhat enterprise Linux for ibm z systems=7.6_s390x
redhat enterprise Linux for ibm z systems=7.7_s390x
redhat enterprise Linux for power big endian=5.0_ppc
redhat enterprise Linux for power big endian=5.9_ppc
redhat enterprise Linux for power big endian=6.0_ppc64
redhat enterprise Linux for power big endian=6.4_ppc64
redhat enterprise Linux for power big endian=7.0_ppc64
redhat enterprise Linux for power big endian eus=6.5_ppc64
redhat enterprise Linux for power big endian eus=7.3_ppc64
redhat enterprise Linux for power big endian eus=7.4_ppc64
redhat enterprise Linux for power big endian eus=7.5_ppc64
redhat enterprise Linux for power big endian eus=7.6_ppc64
redhat enterprise Linux for power big endian eus=7.7_ppc64
redhat enterprise Linux for scientific computing=6.0
redhat enterprise Linux for scientific computing=7.0
redhat enterprise Linux server=5.0
redhat enterprise Linux server=6.0
redhat enterprise Linux server=7.0
redhat enterprise Linux server aus=5.6
redhat enterprise Linux server aus=5.9
redhat enterprise Linux server aus=6.2
redhat enterprise Linux server aus=6.4
redhat enterprise Linux server aus=6.5
redhat enterprise Linux server aus=7.3
redhat enterprise Linux server aus=7.4
redhat enterprise Linux server aus=7.6
redhat enterprise Linux server aus=7.7
Red Hat Enterprise Linux Server Supplementary EUS=5.0
Red Hat Enterprise Linux Server Supplementary EUS=6.0
Red Hat Enterprise Linux Server Supplementary EUS=7.0
redhat enterprise Linux server tus=6.5
redhat enterprise Linux server tus=7.3
redhat enterprise Linux server tus=7.6
redhat enterprise Linux server tus=7.7
redhat enterprise Linux workstation=5.0
redhat enterprise Linux workstation=6.0
redhat enterprise Linux workstation=7.0
SUSE Studio Onsite=1.3
openSUSE=12.3
openSUSE=13.1
openSUSE=13.2
SUSE Linux Enterprise Desktop with Beagle=11-sp3
SUSE Linux Enterprise Desktop with Beagle=12
SUSE Linux Enterprise Server=10-sp3
SUSE Linux Enterprise Server=10-sp4
SUSE Linux Enterprise Server=11-sp1
SUSE Linux Enterprise Server=11-sp2
SUSE Linux Enterprise Server=11-sp3
suse linux enterprise server vmware=11-sp3
SUSE Linux Enterprise Server=12
SUSE Linux Enterprise Software Development Kit=11-sp3
SUSE Linux Enterprise Software Development Kit=12
Debian=7.0
IBM InfoSphere Guardium Activity Monitor=8.2
IBM InfoSphere Guardium Activity Monitor=9.0
IBM InfoSphere Guardium Activity Monitor=9.1
IBM PureApplication System>=1.0.0.0<=1.0.0.4
IBM PureApplication System>=1.1.0.0<=1.1.0.4
IBM PureApplication System=2.0.0.0
IBM QRadar Risk Manager=7.1.0
IBM QRadar Security Information and Event Manager=7.1.0
IBM QRadar Security Information and Event Manager=7.1.0-mr1
IBM QRadar Security Information and Event Manager=7.1.0-mr2
IBM QRadar Security Information and Event Manager=7.1.1
IBM QRadar Security Information and Event Manager=7.1.1-p1
IBM QRadar Security Information and Event Manager=7.1.1-p2
IBM QRadar Security Information and Event Manager=7.1.1-p3
IBM QRadar Security Information and Event Manager=7.1.2
IBM QRadar Security Information and Event Manager=7.1.2-p1
IBM QRadar Security Information and Event Manager=7.1.2-p10
IBM QRadar Security Information and Event Manager=7.1.2-p11
IBM QRadar Security Information and Event Manager=7.1.2-p12
IBM QRadar Security Information and Event Manager=7.1.2-p13
IBM QRadar Security Information and Event Manager=7.1.2-p2
IBM QRadar Security Information and Event Manager=7.1.2-p3
IBM QRadar Security Information and Event Manager=7.1.2-p4
IBM QRadar Security Information and Event Manager=7.1.2-p5
IBM QRadar Security Information and Event Manager=7.1.2-p6
IBM QRadar Security Information and Event Manager=7.1.2-p7
IBM QRadar Security Information and Event Manager=7.1.2-p8
IBM QRadar Security Information and Event Manager=7.1.2-p9
IBM QRadar Security Information and Event Manager=7.2
IBM QRadar Security Information and Event Manager=7.2.0
IBM QRadar Security Information and Event Manager=7.2.0-p1
IBM QRadar Security Information and Event Manager=7.2.0-p2
IBM QRadar Security Information and Event Manager=7.2.0-p3
IBM QRadar Security Information and Event Manager=7.2.1
IBM QRadar Security Information and Event Manager=7.2.1-p1
IBM QRadar Security Information and Event Manager=7.2.1-p2
IBM QRadar Security Information and Event Manager=7.2.1-p3
IBM QRadar Security Information and Event Manager=7.2.2
IBM QRadar Security Information and Event Manager=7.2.2-p1
IBM QRadar Security Information and Event Manager=7.2.2-p2
IBM QRadar Security Information and Event Manager=7.2.2-p3
IBM QRadar Security Information and Event Manager=7.2.2-p4
IBM QRadar Security Information and Event Manager=7.2.3
IBM QRadar Security Information and Event Manager=7.2.3-p1
IBM QRadar Security Information and Event Manager=7.2.3-p2
IBM QRadar Security Information and Event Manager=7.2.3-p3
IBM QRadar Security Information and Event Manager=7.2.3-p4
IBM QRadar Security Information and Event Manager=7.2.4
IBM QRadar Security Information and Event Manager=7.2.4-p1
IBM QRadar Security Information and Event Manager=7.2.4-p2
IBM QRadar Security Information and Event Manager=7.2.4-p3
IBM QRadar Security Information and Event Manager=7.2.4-p4
IBM QRadar Security Information and Event Manager=7.2.4-p5
IBM QRadar Security Information and Event Manager=7.2.4-p6
IBM QRadar Security Information and Event Manager=7.2.5
IBM QRadar Security Information and Event Manager=7.2.5-p1
IBM QRadar Security Information and Event Manager=7.2.5-p2
IBM QRadar Security Information and Event Manager=7.2.5-p3
IBM QRadar Security Information and Event Manager=7.2.5-p4
IBM QRadar Security Information and Event Manager=7.2.5-p5
IBM QRadar Security Information and Event Manager=7.2.5-p6
IBM QRadar Security Information and Event Manager=7.2.6
IBM QRadar Security Information and Event Manager=7.2.6-p1
IBM QRadar Security Information and Event Manager=7.2.6-p2
IBM QRadar Security Information and Event Manager=7.2.6-p3
IBM QRadar Security Information and Event Manager=7.2.6-p4
IBM QRadar Security Information and Event Manager=7.2.6-p5
IBM QRadar Security Information and Event Manager=7.2.6-p6
IBM QRadar Security Information and Event Manager=7.2.6-p7
IBM QRadar Security Information and Event Manager=7.2.7
IBM QRadar Security Information and Event Manager=7.2.7-p1
IBM QRadar Security Information and Event Manager=7.2.7-p2
IBM QRadar Security Information and Event Manager=7.2.7-p3
IBM QRadar Security Information and Event Manager=7.2.7-p4
IBM QRadar Security Information and Event Manager=7.2.8
IBM QRadar Security Information and Event Manager=7.2.8-p1
IBM QRadar Security Information and Event Manager=7.2.8-p10
IBM QRadar Security Information and Event Manager=7.2.8-p11
IBM QRadar Security Information and Event Manager=7.2.8-p12
IBM QRadar Security Information and Event Manager=7.2.8-p13
IBM QRadar Security Information and Event Manager=7.2.8-p14
IBM QRadar Security Information and Event Manager=7.2.8-p15
IBM QRadar Security Information and Event Manager=7.2.8-p16
IBM QRadar Security Information and Event Manager=7.2.8-p2
IBM QRadar Security Information and Event Manager=7.2.8-p3
IBM QRadar Security Information and Event Manager=7.2.8-p4
IBM QRadar Security Information and Event Manager=7.2.8-p5
IBM QRadar Security Information and Event Manager=7.2.8-p6
IBM QRadar Security Information and Event Manager=7.2.8-p7
IBM QRadar Security Information and Event Manager=7.2.8-p8
IBM QRadar Security Information and Event Manager=7.2.8-p9
IBM QRadar Security Information and Event Manager=7.2.8.15
IBM QRadar Security Information and Event Manager=7.2.9
IBM QRadar Vulnerability Manager=7.2.0
IBM QRadar Vulnerability Manager=7.2.1
IBM QRadar Vulnerability Manager=7.2.2
IBM QRadar Vulnerability Manager=7.2.3
IBM QRadar Vulnerability Manager=7.2.4
IBM QRadar Vulnerability Manager=7.2.6-p1
IBM QRadar Vulnerability Manager=7.2.6-p2
IBM QRadar Vulnerability Manager=7.2.6-p3
IBM QRadar Vulnerability Manager=7.2.6-p4
IBM QRadar Vulnerability Manager=7.2.6-p5
IBM QRadar Vulnerability Manager=7.2.6-p6
IBM QRadar Vulnerability Manager=7.2.6-p7
IBM QRadar Vulnerability Manager=7.2.8
IBM QRadar Vulnerability Manager=7.2.8-p1
IBM QRadar Vulnerability Manager=7.2.8-p10
IBM QRadar Vulnerability Manager=7.2.8-p11
IBM QRadar Vulnerability Manager=7.2.8-p12
IBM QRadar Vulnerability Manager=7.2.8-p13
IBM QRadar Vulnerability Manager=7.2.8-p14
IBM QRadar Vulnerability Manager=7.2.8-p15
IBM QRadar Vulnerability Manager=7.2.8-p16
IBM QRadar Vulnerability Manager=7.2.8-p17
IBM QRadar Vulnerability Manager=7.2.8-p2
IBM QRadar Vulnerability Manager=7.2.8-p3
IBM QRadar Vulnerability Manager=7.2.8-p4
IBM QRadar Vulnerability Manager=7.2.8-p5
IBM QRadar Vulnerability Manager=7.2.8-p6
IBM QRadar Vulnerability Manager=7.2.8-p7
IBM QRadar Vulnerability Manager=7.2.8-p8
IBM QRadar Vulnerability Manager=7.2.8-p9
IBM SmartCloud Entry Appliance=2.3.0
IBM SmartCloud Entry Appliance=2.4.0
IBM SmartCloud Entry Appliance=3.1.0
IBM SmartCloud Entry Appliance=3.2.0
IBM SmartCloud Provisioning=2.1.0
ibm software defined network For virtual environments<1.2.1
ibm software defined network For virtual environments<1.2.1
ibm software defined network For virtual environments<1.2.1
IBM Starter Kit for Cloud=2.2.0
IBM Workload Deployer>=3.1.0<=3.1.0.7
IBM Security Access Manager for Mobile=8.0.0.1
IBM Security Access Manager for Mobile=8.0.0.2
IBM Security Access Manager for Mobile=8.0.0.3
IBM Security Access Manager for Mobile=8.0.0.5
IBM Security Access Manager for Web 7.0 Firmware=7.0.0.1
IBM Security Access Manager for Web 7.0 Firmware=7.0.0.2
IBM Security Access Manager for Web 7.0 Firmware=7.0.0.3
IBM Security Access Manager for Web 7.0 Firmware=7.0.0.4
IBM Security Access Manager for Web 7.0 Firmware=7.0.0.5
IBM Security Access Manager for Web 7.0 Firmware=7.0.0.6
IBM Security Access Manager for Web 7.0 Firmware=7.0.0.7
IBM Security Access Manager for Web 7.0 Firmware=7.0.0.8
IBM Security Access Manager for Web 8.0 firmware=8.0.0.2
IBM Security Access Manager for Web 8.0 firmware=8.0.0.3
IBM Security Access Manager for Web 8.0 firmware=8.0.0.5
All of
Any of
IBM Storwize V7000 Firmware>=1.1.0.0<1.4.3.5
IBM Storwize V7000 Firmware>=1.5.0.0<1.5.0.4
IBM Storwize V7000 Firmware>=7.2.0.0<7.2.0.9
IBM Storwize V7000 Firmware>=7.3.0.0<7.3.0.7
IBM Storwize V7000 Firmware
All of
Any of
IBM Storwize V5000>=1.1.0.0<7.1.0.11
IBM Storwize V5000>=7.2.0.0<7.2.0.9
IBM Storwize V5000>=7.3.0.0<7.3.0.7
IBM Storwize V5000 software
All of
Any of
IBM Storwize V3700 Firmware>=1.1.0.0<7.1.0.11
IBM Storwize V3700 Firmware>=7.2.0.0<7.2.0.9
IBM Storwize V3700 Firmware>=7.3.0.0<7.3.0.7
IBM Storwize V3700 software
All of
Any of
IBM Storwize V3500>=1.1.0.0<7.1.0.11
IBM Storwize V3500>=7.2.0.0<7.2.0.9
IBM Storwize V3500>=7.3.0.0<7.3.0.7
IBM Storwize V3500 Firmware
All of
Any of
IBM Flex System V7000 Firmware>=1.1.0.0<7.1.0.11
IBM Flex System V7000 Firmware>=7.2.0.0<7.2.0.9
IBM Flex System V7000 Firmware>=7.3.0.0<7.3.0.7
IBM Flex System V7000 Firmware
All of
Any of
IBM SAN Volume Controller Firmware>=1.1.0.0<7.1.0.11
IBM SAN Volume Controller Firmware>=7.2.0.0<7.2.0.9
IBM SAN Volume Controller Firmware>=7.3.0.0<7.3.0.7
IBM SAN Volume Controller Firmware
All of
Any of
IBM STN6500>=3.8.0.0<3.8.0.07
IBM STN6500>=3.9.1.0<3.9.1.08
IBM STN6500>=4.1.2.0<4.1.2.06
IBM STN6500 Firmware
All of
Any of
IBM STN6800>=3.8.0.0<3.8.0.07
IBM STN6800>=3.9.1.0<3.9.1.08
IBM STN6800>=4.1.2.0<4.1.2.06
IBM STN6800 firmware
All of
Any of
IBM STN7800>=3.8.0.0<3.8.0.07
IBM STN7800>=3.9.1.0<3.9.1.08
IBM STN7800>=4.1.2.0<4.1.2.06
IBM STN7800
Ubuntu=10.04
Ubuntu=12.04
Ubuntu=14.04
Novell ZENworks Configuration Management=10.3
Novell ZENworks Configuration Management=11
Novell ZENworks Configuration Management=11.1
Novell ZENworks Configuration Management=11.2
Novell ZENworks Configuration Management=11.3.0
Novell Open Enterprise Server=2.0-sp3
Novell Open Enterprise Server=11.0-sp2
Check Point Security Gateway<r77.30
F5 Access Policy Manager>=10.1.0<=10.2.4
F5 Access Policy Manager>=11.0.0<=11.5.1
F5 Access Policy Manager=11.6.0
F5 BIG-IP Advanced Firewall Manager>=11.3.0<=11.5.1
F5 BIG-IP Advanced Firewall Manager=11.6.0
F5 BIG-IP Analytics>=11.0.0<=11.5.1
F5 BIG-IP Analytics=11.6.0
f5 big-ip application acceleration manager>=11.4.0<=11.5.1
f5 big-ip application acceleration manager=11.6.0
F5 Application Security Manager>=10.0.0<=10.2.4
F5 Application Security Manager>=11.0.0<=11.5.1
F5 Application Security Manager=11.6.0
F5 BIG-IP Edge Gateway>=10.1.0<=10.2.4
F5 BIG-IP Edge Gateway>=11.0.0<=11.3.0
F5 BIG-IP Global Traffic Manager>=10.0.0<=10.2.4
F5 BIG-IP Global Traffic Manager>=11.0.0<=11.5.1
F5 BIG-IP Global Traffic Manager=11.6.0
F5 BIG-IP>=10.0.0<=10.2.4
F5 BIG-IP>=11.0.0<=11.5.1
F5 BIG-IP=11.6.0
F5 BIG-IP Local Traffic Manager>=10.0.0<=10.2.4
F5 BIG-IP Local Traffic Manager>=11.0.0<=11.5.1
F5 BIG-IP Local Traffic Manager=11.6.0
F5 BIG-IP Policy Enforcement Manager>=11.3.0<=11.5.1
F5 BIG-IP Policy Enforcement Manager=11.6.0
F5 BIG-IP Protocol Security Manager>=10.0.0<=10.2.4
F5 BIG-IP Protocol Security Manager>=11.0.0<=11.4.1
F5 BIG-IP WAN Optimization Manager>=10.0.0<=10.2.4
F5 BIG-IP WAN Optimization Manager>=11.0.0<=11.3.0
F5 BIG-IP WebAccelerator>=10.0.0<=10.2.4
F5 BIG-IP WebAccelerator>=11.0.0<=11.3.0
F5 BIG-IQ Cloud and Orchestration>=4.0.0<=4.4.0
F5 BIG-IQ Device>=4.2.0<=4.4.0
F5 BIG-IQ Security>=4.0.0<=4.4.0
F5 Enterprise Manager>=2.1.0<=2.3.0
F5 Enterprise Manager>=3.0.0<=3.1.1
F5 Traffix Systems Signaling Delivery Controller>=4.0.0<=4.0.5
F5 Traffix Systems Signaling Delivery Controller=3.3.2
F5 Traffix Systems Signaling Delivery Controller=3.4.1
F5 Traffix Systems Signaling Delivery Controller=3.5.1
F5 Traffix Systems Signaling Delivery Controller=4.1.0
All of
F5 ARX Firmware>=6.0.0<=6.4.0
F5 ARX Data Manager
All of
Any of
Citrix NetScaler SDX<9.3.67.5r1
Citrix NetScaler SDX>=10<10.1.129.11r1
Citrix NetScaler SDX>=10.5<10.5.52.11r1
Citrix NetScaler
Apple iOS and macOS>=10.0.0<10.10.0
VMware vCenter Server Appliance=5.0
VMware vCenter Server Appliance=5.0-update_1
VMware vCenter Server Appliance=5.0-update_2
VMware vCenter Server Appliance=5.1
VMware vCenter Server Appliance=5.1-update_1
VMware vCenter Server Appliance=5.1-update_2
VMware vCenter Server Appliance=5.5
VMware vCenter Server Appliance=5.5-update_1
VMware ESX=4.0
VMware ESX=4.1

Remedy

https://bugzilla.redhat.com/show_bug.cgi?id=1141597

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2014-6271?

    The severity of CVE-2014-6271 is critical due to its capacity to allow remote code execution.

  • How do I fix CVE-2014-6271?

    To fix CVE-2014-6271, update to a patched version of GNU Bash, specifically versions 4.3 or later.

  • What systems are affected by CVE-2014-6271?

    CVE-2014-6271 affects GNU Bash versions up to and including 4.3.

  • Can CVE-2014-6271 be exploited remotely?

    Yes, CVE-2014-6271 can be exploited remotely by attackers through crafted environment variables.

  • Is CVE-2014-6271 associated with any specific software products?

    CVE-2014-6271 is associated with GNU Bash and various Linux distributions that incorporate it.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203