Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
CVE coverage

CVE-2014-6271

CVSS 9.8 Actively exploited (KEV) 24 detections found
View on NVD →
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

Detection rules

Source Rule Status Updated
suricata ET EXPLOIT QNAP Shellshock script retrieval rev 5 2024-03-14
suricata ET EXPLOIT Possible Pure-FTPd CVE-2014-6271 attempt rev 3 2024-03-06
suricata ET EXPLOIT Possible CVE-2014-6271 Attempt Against SIP Proxy rev 4 2023-05-24
snort ET EXPLOIT Possible CVE-2014-6271 Attempt Against SIP Proxy rev 3 2023-05-24
suricata ET EXPLOIT VisualDoor Sonicwall SSL VPN Exploit Attempt rev 2 2021-01-25
snort ET EXPLOIT VisualDoor Sonicwall SSL VPN Exploit Attempt rev 2 2021-01-25
suricata ET EXPLOIT QNAP Shellshock CVE-2014-6271 rev 5 2020-10-13
suricata ET EXPLOIT Possible CVE-2014-6271 exploit attempt via malicious DNS rev 2 2019-10-08
suricata ET EXPLOIT Possible CVE-2014-6271 malicious DNS response rev 2 2019-10-08
suricata ET EXPLOIT Possible CVE-2014-6271 exploit attempt via malicious DHCP ACK rev 5 2019-10-08
snort ET EXPLOIT QNAP Shellshock CVE-2014-6271 rev 2 2019-08-15
snort ET EXPLOIT QNAP Shellshock script retrieval rev 2 2019-08-15
suricata ET MALWARE Linux/ShellshockCampaign.DDOSBot Terminate Process CnC Server Message rev 2 2019-07-26
suricata ET MALWARE Linux/ShellshockCampaign.DDOSBot Execute Shell Command CnC Server Message rev 2 2019-07-26
suricata ET MALWARE Linux/ShellshockCampaign.DDOSBot Reporting IP rev 1 2019-07-26
suricata ET MALWARE Linux/ShellshockCampaign.DDOSBot UDP Flood CnC Server Message rev 2 2019-07-26
snort ET TROJAN Linux/ShellshockCampaign.DDOSBot UDP Flood CnC Server Message rev 2 2014-12-05
snort ET TROJAN Linux/ShellshockCampaign.DDOSBot Terminate Process CnC Server Message rev 2 2014-12-05
snort ET TROJAN Linux/ShellshockCampaign.DDOSBot Execute Shell Command CnC Server Message rev 2 2014-12-03
snort ET EXPLOIT Possible CVE-2014-6271 malicious DNS response rev 1 2014-10-15
snort ET EXPLOIT Possible CVE-2014-6271 exploit attempt via malicious DNS rev 1 2014-10-15
snort ET EXPLOIT Possible Pure-FTPd CVE-2014-6271 attempt rev 1 2014-10-02
snort ET EXPLOIT Possible CVE-2014-6271 exploit attempt via malicious DHCP ACK rev 4 2014-10-01
snort ET TROJAN Linux/ShellshockCampaign.DDOSBot Reporting IP rev 1 2014-09-29