Cloudanix VulnDB

CVE-2014-7186

None

CVSS

—

EPSS

64.3%

Published

Sep 28, 2014

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Attend

A long-standing bug in how the shell handles certain script input could let attackers crash programs or potentially run malicious code on unpatched systems.

Exploit Available
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Remote Code Execution
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits remote attackers to trigger out-of-bounds array access in the redirection implementation during parsing of crafted here documents, resulting in application crash or potential unspecified memory corruption effects.

Why it matters to the business

Successful exploitation can lead to service crashes, denial of service, or arbitrary code execution on systems processing untrusted input through affected Bash versions, increasing risk of operational disruption or full system compromise; while published in 2014 with no current KEV listing, the high EPSS score and available exploits warrant attention for legacy deployments.

How an attack unfolds

An attacker supplies specially crafted input containing here documents that abuse the redir_stack handling in parse.y, causing the Bash parser to perform invalid memory access that may crash the process or allow further impact such as code execution.

How to fix it

Upgrade affected packages to the listed fixed versions: webkitgtk on Ubuntu 14.04 LTS to 2.4.8-1ubuntu1~ubuntu14.04.1 and on Ubuntu 16.04 LTS to 2.4.9-2ubuntu2; apply all subsequent security updates for Bash and dependent components.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases, recompile or redeploy any affected applications, and test parsing of known here-document edge cases to verify absence of crashes.

Typical attack path

  1. Identify a network-accessible service or script that invokes Bash with untrusted input containing here documents
  2. Craft malicious here document syntax targeting the redirection stack
  3. Deliver the input to trigger out-of-bounds access during parsing
  4. Observe crash or attempt to leverage memory corruption for code execution

How to detect it

Examine system and application logs for Bash segmentation faults or abrupt process terminations coinciding with input containing here documents; correlate with network traffic or script invocations from untrusted sources.

What your security team should do

  • Prioritize patching all systems using the specified webkitgtk and Bash updates
  • Disable or sandbox legacy Bash-dependent services where upgrades are delayed
  • Review logs for unexplained crashes in shell processes over the past 30 days

The record

The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 bash 0 4.3-9.2
Debian:12 bash 0 4.3-9.2
Debian:13 bash 0 4.3-9.2
Debian:6.0 bash 0 4.1-3+deb6u2
Debian:7 bash 0 4.2+dfsg-0.1+deb7u3
Mageia:3 bash 0 4.2-50.2.mga3
Mageia:4 bash 0 4.2-50.2.mga4
Red Hat:enterprise_linux:5::client bash 0 0:3.2-33.el5_11.4
Red Hat:enterprise_linux:5::client bash-debuginfo 0 0:3.2-33.el5_11.4
Red Hat:enterprise_linux:5::server bash 0 0:3.2-33.el5_11.4
Red Hat:enterprise_linux:5::server bash-debuginfo 0 0:3.2-33.el5_11.4
Red Hat:enterprise_linux:6::client bash 0 0:4.1.2-15.el6_5.2
Red Hat:enterprise_linux:6::client bash-debuginfo 0 0:4.1.2-15.el6_5.2
Red Hat:enterprise_linux:6::client bash-doc 0 0:4.1.2-15.el6_5.2
Red Hat:enterprise_linux:6::computenode bash 0 0:4.1.2-15.el6_5.2
Red Hat:enterprise_linux:6::computenode bash-debuginfo 0 0:4.1.2-15.el6_5.2
Red Hat:enterprise_linux:6::computenode bash-doc 0 0:4.1.2-15.el6_5.2
Red Hat:enterprise_linux:6::server bash 0 0:4.1.2-15.el6_5.2
Red Hat:enterprise_linux:6::server bash-debuginfo 0 0:4.1.2-15.el6_5.2
Red Hat:enterprise_linux:6::server bash-doc 0 0:4.1.2-15.el6_5.2
Red Hat:enterprise_linux:6::workstation bash 0 0:4.1.2-15.el6_5.2
Red Hat:enterprise_linux:6::workstation bash-debuginfo 0 0:4.1.2-15.el6_5.2
Red Hat:enterprise_linux:6::workstation bash-doc 0 0:4.1.2-15.el6_5.2
Red Hat:enterprise_linux:7::client bash 0 0:4.2.45-5.el7_0.4
Red Hat:enterprise_linux:7::client bash-debuginfo 0 0:4.2.45-5.el7_0.4
Red Hat:enterprise_linux:7::client bash-doc 0 0:4.2.45-5.el7_0.4
Red Hat:enterprise_linux:7::computenode bash 0 0:4.2.45-5.el7_0.4
Red Hat:enterprise_linux:7::computenode bash-debuginfo 0 0:4.2.45-5.el7_0.4
Red Hat:enterprise_linux:7::computenode bash-doc 0 0:4.2.45-5.el7_0.4
Red Hat:enterprise_linux:7::server bash 0 0:4.2.45-5.el7_0.4
Red Hat:enterprise_linux:7::server bash-debuginfo 0 0:4.2.45-5.el7_0.4
Red Hat:enterprise_linux:7::server bash-doc 0 0:4.2.45-5.el7_0.4
Red Hat:enterprise_linux:7::workstation bash 0 0:4.2.45-5.el7_0.4
Red Hat:enterprise_linux:7::workstation bash-debuginfo 0 0:4.2.45-5.el7_0.4
Red Hat:enterprise_linux:7::workstation bash-doc 0 0:4.2.45-5.el7_0.4
Red Hat:rhel_els:4::as bash 0 0:3.0-27.el4.4
Red Hat:rhel_els:4::as bash-debuginfo 0 0:3.0-27.el4.4
Red Hat:rhel_els:4::es bash 0 0:3.0-27.el4.4
Red Hat:rhel_els:4::es bash-debuginfo 0 0:3.0-27.el4.4
Red Hat:rhel_eus:5.9 bash 0 0:3.2-32.el5_9.3
Red Hat:rhel_eus:5.9 bash-debuginfo 0 0:3.2-32.el5_9.3
Red Hat:rhel_eus:6.4::computenode bash 0 0:4.1.2-15.el6_4.2
Red Hat:rhel_eus:6.4::computenode bash-debuginfo 0 0:4.1.2-15.el6_4.2
Red Hat:rhel_eus:6.4::computenode bash-doc 0 0:4.1.2-15.el6_4.2
Red Hat:rhel_eus:6.4::server bash 0 0:4.1.2-15.el6_4.2
Red Hat:rhel_eus:6.4::server bash-debuginfo 0 0:4.1.2-15.el6_4.2
Red Hat:rhel_eus:6.4::server bash-doc 0 0:4.1.2-15.el6_4.2
Red Hat:rhel_mission_critical:5.6 bash 0 0:3.2-24.el5_6.2
Red Hat:rhel_mission_critical:5.6 bash-debuginfo 0 0:3.2-24.el5_6.2
Red Hat:rhel_mission_critical:6.2::server bash 0 0:4.1.2-9.el6_2.2
Red Hat:rhel_mission_critical:6.2::server bash-debuginfo 0 0:4.1.2-9.el6_2.2
Red Hat:rhel_mission_critical:6.2::server bash-doc 0 0:4.1.2-9.el6_2.2
Red Hat:rhel_sjis:5 bash 0 0:3.2-33.el5_11.1.sjis.2
Red Hat:rhel_sjis:5 bash 0 0:3.2-32.el5_9.3.sjis.1
Red Hat:rhel_sjis:5 bash-debuginfo 0 0:3.2-33.el5_11.1.sjis.2
Red Hat:rhel_sjis:5 bash-debuginfo 0 0:3.2-32.el5_9.3.sjis.1
Red Hat:rhel_sjis:6 bash 0 0:4.1.2-15.el6_5.1.sjis.2
Red Hat:rhel_sjis:6 bash-debuginfo 0 0:4.1.2-15.el6_5.1.sjis.2
Red Hat:rhel_sjis:6 bash-doc 0 0:4.1.2-15.el6_5.1.sjis.2
Red Hat:rhev_manager:3 rhev-hypervisor6 0 0:6.5-20140930.1.el6ev
Ubuntu:14.04:LTS bash 0 4.3-7ubuntu1.4
openSUSE:Tumbleweed bash 0 7.0-92.1

Related vulnerabilities