Incomplete function parsing in GNU Bash enables crafted-environment file writes

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

The normalized record marks the following products as affected:

• GNU Bash: affected through 4.3 bash43-025.
• Arista EOS: affected, with no specific version boundary supplied.
• Oracle Linux: versions 4, 5, and 6.
• QNAP QTS: one entry with no version specified and entries for 4.1.1, including build 0927.
• Mageia: 3.0 and 4.0.
• Red Hat: Gluster Storage Server for On-Premise 2.1; Virtualization 3.4; Enterprise Linux 4.0, 5.0, 6.0, and 7.0; Enterprise Linux Desktop 5.0, 6.0, and 7.0; EUS branches 5.9, 6.4, 6.5, and 7.3 through 7.7; and the IBM Z, Power Big Endian, Power Big Endian EUS, Scientific Computing, Server, Server AUS, Server from RHUI, Server TUS, and Workstation variants at the versions listed in the record.
• SUSE and openSUSE: Studio Onsite 1.3; openSUSE 12.3, 13.1, and 13.2; Linux Enterprise Desktop 11 and 12; Linux Enterprise Server 10 SP3, 10 SP4, 11 SP1, 11 SP2, 11 SP3, and 12; Linux Enterprise Software Development Kit 11 and 12.
• Debian Linux: 7.0.
• IBM: InfoSphere Guardium Database Activity Monitoring 8.2, 9.0, and 9.1; PureApplication System entries without a specified version and 2.0.0.0; QRadar Risk Manager 7.1.0; QRadar Security Information and Event Manager 7.1.0, 7.1.1, and 7.1.2; QRadar Vulnerability Manager 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.6, and 7.2.8.

For many downstream products, the record identifies an affected product or branch without giving its corresponding fixed boundary. Unlisted later or parallel branches should not be assumed safe.

GNU Bash imports function definitions from environment variable values and, in this case, mishandles trailing text after certain malformed function definitions. This parser flaw remained after an incomplete earlier fix, allowing attacker-controlled environment data to be processed when an environment crosses a privilege boundary into a Bash process. The important deployment precondition is that an attacker can influence the environment before Bash executes. Described vectors include ForceCommand in OpenSSH sshd, the Apache HTTP Server mod_cgi and mod_cgid modules, scripts run by DHCP clients, and similar execution paths. File writing is the confirmed direct outcome; the target files, payload details, and any additional impact are not established by the available record.

The vulnerability can be reached remotely in deployments where external data can influence the environment before Bash is invoked. The structured record indicates that prior privileges and user interaction are not required, although the attacker must still reach an environment-setting path that feeds Bash. The described paths include OpenSSH ForceCommand, Apache mod_cgi and mod_cgid, DHCP client scripts, and other privilege-boundary transitions into Bash execution. The record marks the issue as known exploited and publicly exploitable. The supplied evidence does not identify a campaign, victim, or specific IOC.

The confirmed technical outcome is file writing through Bash processing a crafted environment. If the Bash process has elevated permissions, the affected file may be a configuration file, script, or important data file, but the actual consequence depends on the process permissions and writable locations.

• The scope can extend beyond an interactive shell when Bash is invoked by a daemon, CGI handler, DHCP client, or privileged automation.
• Crossing a privilege boundary can increase the effect on service or system integrity.
• The record does not establish one specific additional impact for every environment, so every Bash installation should not automatically be treated as producing the same outcome.

The confirmed direct consequence is that a remote attacker can cause a Bash process to write files. If Bash runs as a service account or with elevated permissions, that write may alter scripts, configuration, or data accessible to the process, affecting service integrity or availability.

• Exposure is concentrated in systems that accept external data into the environment before invoking Bash.
• OpenSSH ForceCommand, Apache CGI, DHCP client scripts, and privileged automation may expand the impact depending on deployment and permissions.
• Follow-on effects such as code execution, data disclosure, or service takeover are not universally established by the record.

1. Install the supported vendor security update for every affected product and branch. Do not update only a standalone Bash package when the affected software is an appliance, integrated platform, or distribution with its own backports.
2. For upstream GNU Bash, the follow-up information identifies bash43-026 as the fix for Bash 4.3 and bash32-053 as the fix for Bash 3.2. A separate upstream hardening update is identified as bash43-027 and corresponding patches, but vendor-supported packages should be preferred.
3. For Ubuntu 14.04 LTS, the follow-up advisory identifies bash version 4.3-7ubuntu1.3 as corrected. This boundary applies to the stated Ubuntu branch and does not establish fixed releases for other branches or products.
4. Recheck the installed package revision after updating. An Ubuntu follow-up reported that an earlier patch was not properly applied because of a build issue, so the presence of the earlier update alone is not sufficient evidence of remediation.
5. Prioritize hosts and appliances using OpenSSH ForceCommand, Apache mod_cgi or mod_cgid, DHCP client scripts, privileged wrappers, or automation that can place external data into the environment. If patching is not immediately possible, use only a product-specific mitigation documented by the vendor; the available evidence does not establish a universal workaround.

1. Inventory all systems, appliances, and images that install or embed the bash package, then compare the installed package revision with the security fix supplied by the relevant vendor.
2. Identify execution paths that can place attacker-controlled data into the environment before Bash starts, especially OpenSSH ForceCommand, Apache mod_cgi and mod_cgid, DHCP client hooks, privileged wrappers, and scheduled automation.
3. Verify whether systems received a follow-up build after any incomplete or incorrectly packaged update. Do not treat installation of an earlier advisory package as proof of remediation when the vendor reported a build or packaging problem.
4. Review audit logs and file-integrity telemetry for unexpected file creation or modification by services that invoke Bash. This is precautionary monitoring, not a confirmed IOC for this vulnerability.
5. Absence of suspicious log entries does not prove that a system is unaffected; confirm the package revision and the actual execution path.