CVE-2014-7169
CriticalExploitedPublic exploitGNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by…
Published Sep 25, 2014 · Updated Aug 11, 2026 · Also known as DEBIAN-CVE-2014-7169, DLA-63-1, DSA-3035-1, UBUNTU-CVE-2014-7169, USN-2363-1, USN-2363-2
Key Facts
Patch immediately- CVE-2014-7169 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Security Gateway (Checkpoint), Big-Ip Access Policy Manager (F5), Big-Ip Advanced Firewall Manager (F5) and 22 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Sep 30, 2014. Public exploit code is available.
- EPSS estimates a 100% probability of exploitation in the next 30 days.
- Fixed versions are available, including apple mac os x 10.10.0, arista eos 4.9.12, Bash 0:3.0-27.el4.4.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
100%
Higher than 99.9% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2014-7169 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Jan 28, 2022 | Jul 28, 2022 | Not reported |
| Industry KEV feed | Sep 30, 2014 | Jul 28, 2022 | Not reported |
| CIRCL KEV | Jan 28, 2022 | Jul 28, 2022 | Not reported |
| ENISA EUVD | Jan 28, 2022 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
336 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Security GatewayCheckpoint | See advisory | r77.30 |
| Big-Ip Access Policy ManagerF5 | 11.6.0 | 10.2.4 |
| Big-Ip Advanced Firewall ManagerF5 | 11.6.0 | 11.5.1 |
| Big-Ip AnalyticsF5 | 11.6.0 | 11.5.1 |
| Big-Ip Application Acceleration ManagerF5 | 11.6.0 | 11.5.1 |
Patched Releases
apple mac os x
10.10.0
arista eos
4.9.12
Bash
0:3.0-27.el4.4, 0:3.2-33.el5_11.4, 0:4.1.2-9.el6_2.2, 0:4.2.45-5.el7_0.4, 3.2-33.el5_11.4, 3.2-33.el5.1.0.1, 4.1-3+deb6u2, 4.1.2-15.21.amzn1, 4.1.2-15.el6_5.1.0.1, 4.1.2-15.el6_5.2, 4.2.45-5.el7_0.2.0.1, 4.2.45-5.el7_0.4, 4.2+dfsg-0.1+deb7u3, 4.3-7ubuntu1.2, 4.3-7ubuntu1.3, 4.3-9.2, 4.4-92.1, 4.3
bash-devel
4.4-92.1
bash-doc
4.1.2-15.21.amzn1, 4.1.2-15.el6_5.1.0.1, 4.1.2-15.el6_5.2, 4.2.45-5.el7_0.2.0.1, 4.2.45-5.el7_0.4, 4.4-92.1
bash-lang
4.4-92.1
bash-loadables
4.4-92.1
Security Gateway
r77.30
citrix netscaler sdx firmware
9.3.67.5r1
f5 arx firmware
6.4.0
Big-Ip Access Policy Manager
10.2.4
Big-Ip Advanced Firewall Manager
11.5.1
Big-Ip Analytics
11.5.1
Big-Ip Application Acceleration Manager
11.5.1
Big-Ip Application Security Manager
10.2.4
Big-Ip Edge Gateway
10.2.4
Big-Ip Global Traffic Manager
10.2.4
Big-Ip Link Controller
10.2.4
Big-Ip Local Traffic Manager
10.2.4
Big-Ip Policy Enforcement Manager
11.5.1
Big-Ip Protocol Security Module
10.2.4
Big-Ip Wan Optimization Manager
10.2.4
Big-Ip Webaccelerator
10.2.4
Big-Iq Cloud
4.4.0
Big-Iq Device
4.4.0
Timeline
Publicly disclosed
Sep 25, 2014
Added to Industry KEV feed
Sep 30, 2014
Added to CISA KEV
Jan 28, 2022
Added to CIRCL KEV
Jan 28, 2022
Added to ENISA EUVD
Jan 28, 2022
Last updated
Aug 11, 2026
Weakness Type
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-228 Improper Handling of Syntactically Invalid Structure
References
- advisoryhttp://advisories.mageia.org/MGASA-2014-0393.html
- advisoryJVNDB-2014-000126
- advisoryJVN#55667175
- advisoryhttp://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html
- advisoryhttp://linux.oracle.com/errata/ELSA-2014-1306.html
FAQ
Common Questions.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature…
Affected: Security Gateway (Checkpoint); Big-Ip Access Policy Manager (F5) versions 11.6.0; Big-Ip Advanced Firewall Manager (F5) versions 11.6.0, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Sep 30, 2014.
Yes. It was added on Jan 28, 2022 with a federal remediation due date of Jul 28, 2022.
Public exploit code is available.
Fixed versions are available, including apple mac os x 10.10.0, arista eos 4.9.12, Bash 0:3.0-27.el4.4.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2014-7169 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo