CVE-2014-6271: Mitigating the Bash Shellshock Exploit | Qualys
Summary: Bash processes specially crafted environment variables in a way that allows remote code execution, and because Bash is a common install on Linux and Unix systems and is invoked by programs like SSH, telnet and CGI scripts, the flaw can be reached over the network. Qualys released QID 122693 to detect CVE-2014-6271 and QID 13038 for remote detection, and noted the original fix was incomplete, with command injection still possible under CVE-2014-7169 and further bypass reports tracked as CVE-2014-6277 and CVE-2014-6278.
Why it matters: The patch organizations applied for Shellshock did not close the hole, so a host that tested clean against CVE-2014-6271 could still be executing injected commands through CVE-2014-7169 and the later bypasses.
Read the original at Qualys Blog ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2014-6271CVE-2014-6277CVE-2014-6278CVE-2014-7169CVE-2014-7186CVE-2014-7187
- Related
- CVE-2014-6278: GNU Bash OS Command Injection Vulnerability Known Exploited Vulnerabilities · Oct 02, 2025CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Jan 28, 2022CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Jan 28, 2022