CVE-2014-6271 - Remotely Exploitable Vulnerability in Bash

Summary: Volexity's September 24, 2014 post flagged CVE-2014-6271, a remotely exploitable vulnerability in bash, noting patches were already available for most major Linux distributions at the time the details went public. The post described simple IDS signatures looking for the string "() {" in HTTP headers, and reported early scanning from Errata Security at 209.126.230.72 and a later wave from 89.207.135.125 targeting cPanel's /cgi-sys/defaultwebpage.cgi.
Bottom line: The first observed traffic against Volexity's monitoring networks was wide-ranging scanning, not targeted attack, and the author noted that researchers, criminals and nation-states were already working out how else to exploit it. A signature that matches a single string in an HTTP header is a stopgap, and the author said a pcre version catching evasive variants was not yet ready for release.

Read the original at Volexity Blog ↗

Topics: Detection & Response
Mentions: CVE-2014-6271
Related: CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Jan 28, 2022
Another Major Vulnerability Bashes Systems Cyber Risks ·
Shellshock - Update Bash Immediately! Cyber Risks ·