{"data":{"case":{"actions":{"de":["Aktualisiere Bash über die Updates deines Systems: Bash 4.3 braucht die **Patches 025 bis 030**, ältere Versionen die entsprechenden Patches.","Prüfe eingebettete Geräte, etwa Geräte mit eingebautem Linux, die keine Updates mehr bekommen: Auf ihnen kann noch eine ungepatchte Bash laufen.","Schalte CGI-Skripte auf Webservern ab, die du nicht mehr brauchst: Über sie gelangte eine einzige präparierte Webanfrage bis zu Bash."],"en":["Update Bash through your system's updates: Bash 4.3 needs **patches 025 to 030**, older versions the matching patches.","Check embedded devices, such as appliances with built-in Linux, that no longer get updates: they may still run an unpatched Bash.","Switch off CGI scripts on web servers that you no longer need: a single crafted web request reached Bash through them."]},"criteria":{"damage":{"de":"Weder Schadenszahlen noch Ausfälle kritischer Dienste sind belegt; die Angriffszahlen stammen aus Sensoren der Anbieter, nicht aus Schadensmeldungen.","en":"No damage figures and no outages of critical services are documented; the attack counts come from vendors' sensors, not from damage reports.","met":false},"exploitation":{"de":"Innerhalb von vier Tagen trafen Angriffe mehr als 4.115 von Imperva geschützte Websites, und Cloudflare blockierte mehr als 1,1 Millionen Angriffe (Anbieterdaten von Imperva und Cloudflare).","en":"Within four days, attacks hit more than 4,115 websites protected by Imperva, and Cloudflare blocked more than 1.1 million attacks (vendor data from Imperva and Cloudflare).","met":true},"reach":{"de":"Bash gehört bei Linux und macOS zum Grundbestand des Betriebssystems (US-CERT), und auf Linux allein laufen heute 63,2 % aller Websites, deren Betriebssystem bekannt ist (W3Techs, 23. Oktober 2026).","en":"Bash is part of the base operating system of Linux and macOS (US-CERT), and Linux alone runs 63.2 % of all websites whose operating system is known today (W3Techs, October 23, 2026).","met":true},"response":{"de":"In elf Tagen erschienen sechs Bash-Patches, aber keine Maßnahme über das übliche Patchen hinaus ist belegt (Patch-Archiv von GNU Bash, US-CERT).","en":"Six Bash patches came out in eleven days, but no measure beyond routine patching is documented (GNU Bash patch archive, US-CERT).","met":false}},"cves":["CVE-2014-6271","CVE-2014-7169","CVE-2014-7186","CVE-2014-7187","CVE-2014-6277","CVE-2014-6278"],"cvss":9.8,"cvss_version":"3.1","cwe":"CWE-78","dates":[{"date":"2014-09-15","de":"Früheste belegte Meldung, im Bug-Tracker von Red Hat, noch geheim","en":"Earliest documented report, in Red Hat's bug tracker, still kept secret"},{"date":"2014-09-24","key":"disclosed"},{"date":"2014-09-24","key":"patched"},{"date":"2014-09-25","de":"Der erste Fix erweist sich als unvollständig; seine Umgehung erhält eine eigene CVE-Nummer","en":"The first fix proves incomplete; the way around it gets its own CVE"},{"date":"2014-09-26","de":"Die Angriffe erreichen in den Sensordaten von Cisco ihren Höhepunkt","en":"Attacks peak in Cisco's sensor data"},{"date":"2014-10-05","de":"Sechster und letzter Bash-Patch der Reihe","en":"Sixth and last Bash patch of the series"}],"de":{"credit":"Ein unabhängiger Unix- und Linux-Spezialist; die Folgelücken fanden andere Forscher","fixed":"Patches 025 bis 030 für Bash 4.3 (24. September bis 5. Oktober 2014) und entsprechende Patches für ältere Versionen","product":"GNU Bash, die Shell von Linux, Unix und macOS","summary":"Eine Lücke in Bash, der Shell von Linux und macOS, ließ Angreifer mit einer einzigen präparierten Anfrage Befehle auf Webservern ausführen."},"disclosed":"2014-09-24","en":{"credit":"An independent Unix and Linux specialist; follow-up flaws by other researchers","fixed":"Bash 4.3 patches 025 to 030 (September 24 to October 5, 2014) and matching patches for older versions","product":"GNU Bash, the command shell of Linux, Unix and macOS","summary":"A flaw in Bash, the command shell of Linux and macOS, let attackers run commands on web servers with a single crafted request."},"figures":[{"de":"der Websites mit bekanntem Betriebssystem laufen heute auf Linux, bei dem Bash zum System gehört","en":"of websites with a known operating system run on Linux today, where Bash is part of the system","value":"63.2 %"},{"de":"Shellshock-Angriffe pro Sekunde zu Beginn, allein bei Cloudflare (Anbieterdaten)","en":"Shellshock attacks per second at first, at Cloudflare alone (vendor data)","value":"10–15"},{"de":"Bash-Patches in elf Tagen, weil die ersten Fixes unvollständig waren","en":"Bash patches in eleven days, because the first fixes were incomplete","value":"6"}],"kev":"2022-01-28","key":"shellshock","name":"Shellshock","product":"GNU Bash","sources":[{"de":"oss-security: der erste öffentliche Sicherheitshinweis zu CVE-2014-6271","title":"oss-security: the first public advisory on CVE-2014-6271","url":"https://www.openwall.com/lists/oss-security/2014/09/24/10"},{"de":"GNU-Projekt: die offiziellen Patches für Bash 4.3, mit Datum","title":"GNU project: the official Bash 4.3 patches, with their dates","url":"https://ftp.gnu.org/gnu/bash/bash-4.3-patches/"},{"de":"US-CERT-Warnung TA14-268A zu Shellshock","title":"US-CERT alert TA14-268A on Shellshock","url":"https://www.cisa.gov/news-events/alerts/2014/09/25/gnu-bourne-again-shell-bash-shellshock-vulnerability-cve-2014-6271"},{"de":"Red Hat Bugzilla: der Eintrag zu CVE-2014-6271, unter Embargo geführt","title":"Red Hat Bugzilla: the entry for CVE-2014-6271, tracked under embargo","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1141597"},{"de":"NVD: CVE-2014-6271","title":"NVD: CVE-2014-6271","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6271"},{"de":"Cisco Talos: Shellshock-Angriffe im Netz (Anbieterdaten)","title":"Cisco Talos: Shellshock exploits in the wild (vendor data)","url":"https://blogs.cisco.com/security/talos/shellshock-exploits-in-the-wild"},{"de":"Cloudflare: Shellshock im Detail (Anbieterdaten)","title":"Cloudflare: Inside Shellshock (vendor data)","url":"https://blog.cloudflare.com/inside-shellshock"},{"de":"Imperva: die Folgen von Shellshock (Anbieterdaten)","title":"Imperva: The Shellshock Aftermath (vendor data)","url":"https://www.imperva.com/blog/?p=7791"},{"de":"W3Techs: Nutzungsstatistik von Linux","title":"W3Techs: usage statistics of Linux","url":"https://w3techs.com/technologies/details/os-linux"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","year":2014}},"description":"A flaw in Bash, the command shell of Linux and macOS, let attackers run commands on web servers with one request. How it worked, the attacks, the fix.","language":"en","latest_measurement":"2026-10-23","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"On September 24, 2014, a flaw became public in Bash, the command shell of Linux, Unix, and macOS: the program that reads commands and runs them. Through it, a single crafted web request could run any command on a web server. Cisco\u0026rsquo;s sensors recorded attacks on the same day, and it took six patches in eleven days to close the hole and the flaws found after it.\nHow it worked Programs pass settings to the programs they start in environment variables: small pieces of text, each with a name. Bash uses them for one more job. It can hand its own small programs, called functions, to the next Bash it starts, by putting them into a variable whose text begins with () {.\nEvery new Bash process looked through all of its variables and turned each one that looked like a function into a function. To do that, it ran the text through its normal command reader, the parser. But the parser did not stop at the closing brace of the function: it also ran any command written after it.\nThis would have been harmless if only Bash wrote such variables. But many programs copy outside input into variables before they start a shell. Web servers do it for CGI scripts, small programs that a server starts to build a page: the User-Agent header of a request, the line that normally names the browser, becomes the variable HTTP_USER_AGENT. DHCP clients, which fetch network settings, do the same with settings sent by the network, and so does OpenSSH, the program for remote logins, for accounts limited to one fixed command.\nAttackerputs a command after a function in a request header Web servercopies the header into a variable for a CGI script Bashstarts and reads the variable as a function Commandruns on the server One request was enough: the web server passed the header on, and Bash ran whatever came after the function. Reach and attacks Bash is part of the base operating system of Linux and macOS, wrote US-CERT, the US government\u0026rsquo;s computer emergency team, in its alert. Linux alone runs 63.2 % of all websites whose operating system is known today, according to W3Techs. Not every such server could be attacked, though: an attacker needed a path from outside into Bash, such as a CGI script.\nNo independent study measured how many systems were vulnerable or attacked. All attack counts come from security vendors, and each vendor sees only its own customers, so their numbers cannot be added up:\nCloudflare, which filters traffic for websites, blocked well over 1.1 million Shellshock attacks by September 30, 2014. At first, it saw 10 to 15 attacks per second. Incapsula, a firewall service of Imperva, deflected over 217,089 attempts against over 4,115 websites in the four days after the disclosure. They came from more than 890 IP addresses. Cisco\u0026rsquo;s sensors showed the attacks peaking on September 26, 2014, with another spike two days later. Average Shellshock attacks per hour in Incapsula\u0026#39;s data First report, September 26725 After four days, September 291,970 Vendor data from Imperva, covering only the websites its service protects. The first value is approximate, the second a minimum.\nMost of these attacks were tests. In Cloudflare\u0026rsquo;s data, about 83 % were reconnaissance: requests that only check whether a server is vulnerable. About 8 % tried to take over the server directly.\nWhat Shellshock attacks tried in Cloudflare\u0026#39;s data Reconnaissance, testing whether a server is vulnerable83 % Direct attempts to take over the server8 % Vendor data from Cloudflare, September 30, 2014. Both shares are approximate.\nSix patches in eleven days The Bash project released its first patch on the day of the disclosure. It was incomplete. On September 25, a second flaw got its own number, CVE-2014-7169, because Bash still ran trailing text after certain broken function definitions. Researchers then found more flaws in the parser, and the US-CERT alert grew to six CVE numbers by September 30.\nPatchDateWhat it fixed bash43-025September 24, 2014The original flaw, CVE-2014-6271 bash43-026September 26, 2014The way around the first patch, CVE-2014-7169 bash43-027September 27, 2014A new way to pass on functions, which closes the whole class of flaws bash43-028October 1, 2014Two memory errors in the parser, CVE-2014-7186 and CVE-2014-7187 bash43-029October 2, 2014A parser flaw that matches CVE-2014-6277 bash43-030October 5, 2014A parser flaw that matches CVE-2014-6278 The lasting fix was patch 027. Since then, Bash passes on functions only under special variable names (BASH_FUNC_name%%), so an ordinary variable, such as one filled from a web request, is never treated as code. With it in place, the later parser flaws could no longer be reached through variables. Older Bash versions received matching patches, and Linux distributions shipped them as updates. Red Hat, for example, had tracked the report since September 15, 2014, under embargo: kept secret until a fix was ready.\nUS-CERT\u0026rsquo;s alert gave the flaw the highest possible impact rating, 10. Today, the NVD, the US National Vulnerability Database, rates the original flaw 9.8 out of 10 on version 3.1 of the CVSS scale; on the older version 2, all six Shellshock CVEs score 10. CISA, the US cyber agency, added the original flaw and the first bypass to its list of exploited vulnerabilities on January 28, 2022, and one of the later parser flaws, CVE-2014-6278, on October 2, 2025.","title":"Shellshock: the Bash flaw that let one web request run commands","url":"https://crackthe.net/vulnerabilities/shellshock/"}