CVE-2014-7169

CRITICAL(9.8)KEVLikely Exploited

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

Description

CVE-2014-7169 is a CRITICAL OS command injection vulnerability (CWE-78) in GNU Bash through version 4.3, representing an incomplete fix for the original Shellshock vulnerability (CVE-2014-6271). The initial patch for CVE-2014-6271 did not fully address the underlying parsing flaw, allowing attackers to continue executing arbitrary commands through specially crafted environment variable values using alternative injection techniques. With a CVSS 3.1 score of 9.8, this vulnerability shares the same devastating impact characteristics as its predecessor: network-exploitable, no authentication required, no user interaction needed, and affecting virtually every Unix/Linux system running Bash. CISA added CVE-2014-7169 to its KEV catalog on January 28, 2022, with a remediation deadline of July 28, 2022. The EPSS score of 0.90108 (99.59th percentile) confirms extremely high exploitation activity.

KEV Information

Vendor
GNU
Product
Bourne-Again Shell (Bash)
Date Added
January 28, 2022
Due Date
July 28, 2022
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9

CWEs

CWE-78OS Command Injection

Improper Neutralization of Special Elements used in an OS Command

Affected Products

VendorProductVersion
gnubash<= 4.3
aristaeos>= 4.9.0, < 4.9.12; >= 4.10.0, < 4.10.9; >= 4.11.0, < 4.11.11; >= 4.12.0, < 4.12.9; >= 4.13.0, < 4.13.9; >= 4.14.0, < 4.14.4f
oraclelinux4; 5; 6
qnapqts< 4.1.1; 4.1.1
mageiamageia3.0; 4.0
redhatgluster storage server for on-premise2.1
redhatvirtualization3.4
redhatenterprise linux4.0; 5.0; 6.0; 7.0
redhatenterprise linux desktop5.0; 6.0; 7.0
redhatenterprise linux eus5.9; 6.4; 6.5; 7.3; 7.4; 7.5; 7.6; 7.7
redhatenterprise linux for ibm z systems5.9_s390x; 6.4_s390x; 6.5_s390x; 7.3_s390x; 7.4_s390x; 7.5_s390x; 7.6_s390x; 7.7_s390x
redhatenterprise linux for power big endian5.0_ppc; 5.9_ppc; 6.0_ppc64; 6.4_ppc64; 7.0_ppc64
redhatenterprise linux for power big endian eus6.5_ppc64; 7.3_ppc64; 7.4_ppc64; 7.5_ppc64; 7.6_ppc64; 7.7_ppc64
redhatenterprise linux for scientific computing6.0; 7.0
redhatenterprise linux server5.0; 6.0; 7.0
redhatenterprise linux server aus5.6; 5.9; 6.2; 6.4; 6.5; 7.3; 7.4; 7.6; 7.7
redhatenterprise linux server from rhui5.0; 6.0; 7.0
redhatenterprise linux server tus6.5; 7.3; 7.6; 7.7
redhatenterprise linux workstation5.0; 6.0; 7.0
susestudio onsite1.3

Multiple CVSS Assessments

Source: [email protected](Primary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
9.8
CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Weakness Type

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

OS Command Injection vulnerabilities allow attackers to execute arbitrary operating system commands by injecting malicious input into shell command construction. This weakness class targets system shells like Bash, cmd.exe, and PowerShell, where metacharacters such as semicolons, pipes, backticks, and command substitution operators can alter the intended command structure. The consequences of successful OS command injection range from data theft and system modification to complete infrastructure compromise.

CVE-2014-7169 specifically addresses a bypass of the initial Shellshock fix (CVE-2014-6271). While the first patch attempted to restrict the execution of trailing commands after function definitions in environment variables, it did not completely eliminate the parsing vulnerability. Researchers discovered that by using different syntax patterns, such as redirecting output with > or using parser state confusion techniques, the patch could be circumvented. The vulnerability demonstrates a common challenge in security patching: the initial fix addressed the specific exploitation technique rather than the root cause, leaving the fundamental parser flaw exploitable through alternative methods. This is why CVE-2014-7169 was assigned as a separate CVE and required a second, more comprehensive patch. Learn more about OS Command Injection (CWE-78)

Impact Analysis

CVE-2014-7169 carries a CVSS 3.1 base score of 9.8 (CRITICAL), identical to the original Shellshock vulnerability it bypasses.

Confidentiality (High): Like CVE-2014-6271, successful exploitation allows arbitrary command execution with the privileges of the targeted process. This provides full access to all data accessible by the service account, including web application source code, database credentials, API keys, cryptographic material, and user data. Systems patched only for CVE-2014-6271 but not CVE-2014-7169 remained fully vulnerable to data exfiltration through this bypass.

Integrity (High): Command execution enables the attacker to modify files, install persistent backdoors, alter system configurations, deploy malware, and manipulate application logic. The bypass nature of this vulnerability means that organizations that believed they had remediated Shellshock by applying only the first patch were still exposed to all the same integrity impacts.

Availability (High): Attackers can terminate processes, consume resources, encrypt or delete data, and render systems inoperable. The continued vulnerability of systems that applied only the initial patch extended the window of exploitation for Shellshock-based campaigns, resulting in additional compromises during the period between the two patches.

Scope (Unchanged): The scope remains technically unchanged but practically extends to the entire server environment when web-facing services are compromised. The EPSS score of 0.90108 (99.59th percentile) confirms that this bypass variant is also heavily exploited, particularly against systems where administrators applied only the first Shellshock patch.

Exploit Maturity

Active Exploitation: CVE-2014-7169 has been actively exploited in the wild, particularly in the critical period between the release of the initial Shellshock patch and the more comprehensive fix. CISA added it to the KEV catalog on January 28, 2022, confirming continued exploitation. Threat actors adapted their Shellshock exploits to use the bypass techniques almost immediately after the first patch was released.

Ransomware Association: The CISA KEV catalog does not directly associate CVE-2014-7169 with ransomware campaigns. However, as a command execution vulnerability with identical impact to CVE-2014-6271, it is equally suitable for initial access in ransomware attack chains.

Public Exploits: Multiple public exploits are available, including exploit code on Packet Storm Security and the CA Technologies GNU Bash Shellshock exploit. Oracle published a specific advisory addressing this variant in their products.

EPSS Context: The EPSS score of 0.90108 (99.59th percentile) places this in the top 0.5% of all CVEs for exploitation probability. While slightly lower than CVE-2014-6271's EPSS score, it remains extraordinarily high, reflecting the ongoing exploitation of systems with incomplete Shellshock patches.

KEV Deadline: The CISA remediation deadline was July 28, 2022. Organizations must ensure they have applied patches that address both CVE-2014-6271 and CVE-2014-7169 to be fully protected against Shellshock.

Remediation

  1. Verify that Bash patches cover both CVE-2014-6271 and CVE-2014-7169. The initial Bash patch for Shellshock was incomplete. Ensure your systems have the comprehensive patch that addresses CVE-2014-7169 and all subsequent Shellshock variants (CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278). Verify by running the test case: env X='() { (a)=>' bash -c "echo date"; cat echo should not create a file named "echo" on patched systems.

  2. Apply vendor-specific patches comprehensively. Each distribution released multiple rounds of Bash updates to address Shellshock variants. On Red Hat/CentOS, Debian/Ubuntu, SUSE, and other distributions, ensure you have the latest Bash package that includes all Shellshock fixes. Check vendor advisories for specific package version requirements.

  3. Audit all systems for incomplete patching. Organizations that applied the first Shellshock patch but not the subsequent updates may have a false sense of security. Run automated vulnerability scans to identify any Bash instances still vulnerable to CVE-2014-7169, including on embedded systems, containers, and virtual machine templates.

  4. Re-scan all systems that were considered patched. After CVE-2014-6271 was patched, many organizations marked Shellshock as remediated. CVE-2014-7169 proved that incomplete patching left systems vulnerable. Re-validate all previously "patched" systems to confirm they are protected against this bypass variant.

  5. Implement defense-in-depth measures. Deploy WAF rules that detect both the original Shellshock pattern and bypass variants. Monitor network traffic for exploitation attempts using updated IDS/IPS signatures that cover CVE-2014-7169-specific payloads.

  6. Discontinue use of Bash in web-facing services where possible. Replace CGI scripts with modern web application frameworks. Where shell scripts are necessary, use alternatives to Bash (dash, ash) that are not affected by Shellshock variants. Apply the principle of least privilege to all service accounts.

Technical Details

CVE-2014-7169 exists because the initial fix for CVE-2014-6271 addressed the specific exploitation technique (trailing commands after function definitions) but did not fully resolve the underlying parser flaw in Bash's environment variable processing. Security researcher Tavis Ormandy demonstrated that the patch could be bypassed using alternative syntax that exploited remaining parser state issues.

The canonical test for this vulnerability uses: env X='() { (a)=>' bash -c "echo date". On vulnerable systems, this creates a file named "echo" containing the output of the date command, demonstrating that the parser still allows unintended code execution through environment variables. The bypass works by exploiting how the parser handles syntax errors within function definitions, causing it to enter a confused state where subsequent command elements are executed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) is identical to CVE-2014-6271 because the exploitation prerequisites and impact are the same. The attack is network-based, requires no authentication, and achieves full command execution. The only difference is the specific payload syntax used to trigger the vulnerability.

The root cause, like CVE-2014-6271, lies in the parse_and_execute() function in variables.c. The initial patch attempted to add bounds checking to prevent execution of trailing commands, but the parser's handling of error conditions and certain syntactic constructs still allowed code execution through different code paths. The final comprehensive fix required a more fundamental restructuring of how Bash processes function definitions from environment variables, limiting the parser to only accept function definition syntax and rejecting all other constructs.

Frequently Asked Questions

What is CVE-2014-7169?

CVE-2014-7169 is a critical command injection vulnerability in GNU Bash through version 4.3 that bypasses the initial patch for the Shellshock vulnerability (CVE-2014-6271). While the first Shellshock fix prevented the original exploitation technique, CVE-2014-7169 demonstrates that alternative syntax patterns could still achieve arbitrary command execution through environment variables, requiring a second, more comprehensive patch.

How is CVE-2014-7169 different from CVE-2014-6271?

Both vulnerabilities exploit the same fundamental flaw in Bash's environment variable function import mechanism. CVE-2014-6271 was the original Shellshock vulnerability, and the first patch attempted to fix it. CVE-2014-7169 was discovered when researchers found that the initial patch was incomplete and could be bypassed using different syntax patterns. The impact is identical: unauthenticated remote command execution on any system where Bash processes environment variables from untrusted sources.

How do I fix CVE-2014-7169?

Ensure your Bash installation includes patches for both CVE-2014-6271 and CVE-2014-7169 (and ideally all subsequent Shellshock variants). Systems that only received the first Shellshock patch remain vulnerable. Update Bash through your distribution's package manager and verify the fix by running the test case. Re-scan all systems that were previously marked as patched for Shellshock.

How severe is CVE-2014-7169?

CVE-2014-7169 is rated CRITICAL with a CVSS 3.1 score of 9.8, identical to the original Shellshock. Its EPSS score of 0.90108 (99.59th percentile) confirms extremely high exploitation probability. The bypass nature of this vulnerability means that many organizations that believed they had addressed Shellshock remained vulnerable until they applied the comprehensive second patch. CISA includes it in the Known Exploited Vulnerabilities catalog alongside CVE-2014-6271.

CVSS Score

9.8
CRITICAL(9.8)

EPSS Score

EPSS Score99.94%
EPSS Percentile100.0%

Dates

PublishedSeptember 25, 2014
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch