This host is installed with GNU Bash Shell and is prone to remote command execution vulnerability.

Successful exploitation will allow remote or local attackers to inject shell commmands, allowing local privilege escalation or remote command execution depending on the application vector. Impact Level: Application

Apply the patch or upgrade to latest version, For updates refer to http://www.gnu.org/software/bash/

GNU bash contains a flaw that is triggered when evaluating environment variables passed from another environment. After processing a function definition, bash continues to process trailing strings.

GNU Bash through 4.3

Login to the target machine with ssh credentials and check its possible to execute the commands via GNU bash shell.

• https://access.redhat.com/solutions/1207723
• https://blogs.akamai.com/2014/09/environment-bashing.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1141597
• https://community.qualys.com/blogs/securitylabs/2014/09/24/

---

Updated on 2017-03-28