Shellshock (CVE-2014-6271)

Shellshock (also called "Bashdoor") is the name given to a family of vulnerabilities in the GNU Bourne Again Shell (Bash), the default command interpreter on most Linux and Unix systems and on Apple's macOS at the time. The root flaw, tracked as CVE-2014-6271, stemmed from how Bash processed environment variables: functions could be defined inside an environment variable's value, but Bash continued to parse and execute any commands that followed the function definition, even though they should have been treated as inert trailing text. An attacker who could supply an environment variable to a Bash-spawning process — for example through CGI scripts, OpenSSH's ForceCommand and SSH_ORIGINAL_COMMAND, DHCP clients, or other services that pass untrusted input into the shell environment — could achieve remote arbitrary code execution.

Discovery and Disclosure

The bug was discovered by French Unix specialist Stéphane Chazelas, who reported it to Bash maintainer Chet Ramey on September 12, 2014, according to Wikipedia's account of the incident. The vulnerability was publicly disclosed on September 24, 2014, when CVE-2014-6271 was published by NVD with a CVSS v2 base score of 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) — the maximum possible severity, reflecting complete compromise of confidentiality, integrity, and availability with no authentication required.

Incomplete Fixes and Related CVEs

The initial patch for CVE-2014-6271 proved incomplete, leading to a rapid sequence of follow-on CVEs as researchers and vendors iterated on the fix:

CVE-2014-7169 (published September 25, 2014) showed that Bash still processed trailing strings after malformed function definitions, again enabling remote code execution or arbitrary file writes. CVE-2014-6277 (published September 27, 2014) and CVE-2014-6278 (published September 30, 2014) covered further parsing flaws in function definitions that could allow code execution or denial of service via uninitialized memory access and untrusted-pointer operations. CVE-2014-7186 and CVE-2014-7187 (both published September 28, 2014) addressed separate, less severe memory-safety bugs in Bash's parser — an out-of-bounds array access in redirection handling (the "redir_stack" issue) and an off-by-one error in the read_token_word function (the "word_lineno" issue) — both primarily causing crashes rather than code execution. Affected Bash versions spanned roughly 1.0.3 through 4.3, according to Wikipedia.

Impact and Exploitation

Because Bash was ubiquitous on Linux/Unix servers, embedded devices, and network appliances, and because many web servers invoked Bash indirectly through CGI, the vulnerability had an enormous attack surface. Exploitation attempts began within hours of disclosure. Per Wikipedia's summary, by September 26, 2014, roughly 17,400 attacks against more than 1,800 domains from about 400 distinct IP addresses had been observed, and by September 30 daily attack/probe volume was estimated at around 1.5 million. Botnets (reported under names including "wopbot") reportedly launched DDoS activity against targets including Akamai's network and U.S. Department of Defense infrastructure; a reported compromise of a Yahoo server via Shellshock in early October 2014 was disputed by Yahoo.

Response

Major Linux distributions (Red Hat, Debian, Ubuntu, SUSE), Oracle, Apple, and vendors such as F5, Citrix, VMware, and IBM issued advisories and patches within days, with multiple patch revisions required as the follow-on CVEs surfaced (e.g., Red Hat's RHSA-2014-1293, -1294, -1295, and -1354). US-CERT/CISA issued alert TA14-268A covering the Bash vulnerabilities and mitigation guidance. Given its severity, ease of exploitation, and the ubiquity of Bash, Shellshock was widely compared in severity to the Heartbleed OpenSSL bug disclosed earlier the same year.

Timeline

• 2014-09-12Stéphane Chazelas discovers the Bash function-export parsing flaw and reports it to Bash maintainer Chet Ramey (per Wikipedia).
• 2014-09-24CVE-2014-6271 publicly disclosed and published by NVD with a CVSS v2 base score of 10.0.
• 2014-09-25CVE-2014-7169 published, documenting that the initial patch for CVE-2014-6271 was incomplete.
• 2014-09-26Widespread exploitation observed; per Wikipedia, roughly 17,400 attacks against 1,800+ domains from ~400 IP addresses were tracked.
• 2014-09-27CVE-2014-6277 published, covering further Bash function-definition parsing flaws (memory access / DoS).
• 2014-09-28CVE-2014-7186 and CVE-2014-7187 published, addressing separate Bash parser memory-safety bugs (redirection handling and an off-by-one in read_token_word).
• 2014-09-30CVE-2014-6278 published; per Wikipedia, daily attack/probe volume was estimated at roughly 1.5 million by this date.