Industrial Cybersecurity Threat Briefing
Vulnerability Summary for CVE-2014-7186,” National Vulnerability Database, September 28, 2014, modified October 9,…
2 passages name itOriginal (opens in a new tab) ↗
CVE-2014-7186 Public exploit EPSS 64.3%
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial…
Summary
The flaw is in the redirection implementation in parse.y of GNU Bash through version 4.3 (patch level bash43-026). An attacker who can supply crafted here-document input to Bash can trigger an out-of-bounds array access that crashes the application, and may possibly achieve other unspecified impact.
Official description · CVE.org
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
63.7 / 100
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 1
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 3 years after disclosure. Public exploit code (Exploit-DB) appeared 1 day after disclosure.
- Disclosedday 0
- Public exploit codeExploit-DB+1 day
- First seen exploitedVulnCheck KEV evidence+3 yrs
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo high- or medium-confidence techniques. The 2 available links are lower confidence and listed below.
Lower-confidence links (2)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Unix ShellT1059.004 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
- Exploit Public-Facing ApplicationT1190 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
What security researchers reported
Named in 1 threat report1 reportboozallen.com
Reports are matched by finding the exact id CVE-2014-7186 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.