CVE-2014-7169

GNU Bash through version 4.3 incorrectly processes trailing strings appended after function definitions in environment variable values, allowing arbitrary code execution; this CVE tracks the residual flaw that remained after the original Shellshock fix in CVE-2014-6271. It is triggered whenever Bash parses an attacker-controlled environment variable containing a function definition followed by trailing content, a pattern common in CGI-based web services, DHCP clients, SSH forced-command deployments, and other places where Unix shells handle environment data. An attacker who triggers the flaw gains arbitrary command execution with the privileges of the process invoking Bash, which on exposed web or network services can mean direct remote code execution. Any system running Bash 4.3 or earlier is affected, which effectively includes virtually every Linux and Unix deployment plus many embedded and network devices. Exploitation is confirmed: the flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-01-28) and carries a 99.9% EPSS probability of exploitation within 30 days.

What to do: Apply updated Bash packages from your OS vendor per CISA's required action, ensuring the update addresses both CVE-2014-6271 and this follow-on flaw (CVE-2014-7169). Prioritize internet-facing systems that invoke Bash with attacker-influenced environment variables, such as web servers running CGI scripts and devices processing DHCP or SSH command environments. After patching, verify the fix using your vendor's recommended Shellshock regression test rather than ad-hoc checks.