CVE-2014-6277 log

Source
Severity Critical
Remote Yes
Type Arbitrary code execution
Description
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.
Group Package Affected Fixed Severity Status Ticket
AVG-924 bash 4.3.026-1 4.3.027-1 Critical Fixed
References
http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126
http://jvn.jp/en/jp/JVN55667175/index.html
https://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html