ELSA-2014-3075 -- Oracle bashID: oval:org.secpod.oval:def:1500730 | Date: (C)2014-09-26 (M)2023-12-07 |
Class: PATCH | Family: unix |
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution