nerdexam
EC-Council

312-50V9 · Question #392

Which of the following is a vulnerability in GNU's bash shell (discovered in September of 2014) that gives attackers access to run remote commands on a vulnerable system?

The correct answer is A. Shellshock. Shellshock (CVE-2014-6271) is a critical bash vulnerability discovered in September 2014 that allowed attackers to execute arbitrary remote commands by appending malicious code to environment variables.

Vulnerability Analysis

Question

Which of the following is a vulnerability in GNU's bash shell (discovered in September of 2014) that gives attackers access to run remote commands on a vulnerable system?

Options

  • AShellshock
  • BRootshell
  • CRootshock
  • DShellbash

How the community answered

(31 responses)
  • A
    90% (28)
  • B
    6% (2)
  • D
    3% (1)

Why each option

Shellshock (CVE-2014-6271) is a critical bash vulnerability discovered in September 2014 that allowed attackers to execute arbitrary remote commands by appending malicious code to environment variables.

AShellshockCorrect

Shellshock is the name given to CVE-2014-6271, a flaw in how GNU bash processed specially crafted environment variables. When bash was invoked as part of a web request (e.g., via CGI scripts), an attacker could append function definitions with malicious commands that bash would execute, enabling full remote code execution on vulnerable systems.

BRootshell

Rootshell is not a recognized CVE or named vulnerability - it does not correspond to any documented bash exploit.

CRootshock

Rootshock is a fabricated term combining elements of real vulnerability names but does not refer to any actual documented vulnerability.

DShellbash

Shellbash is not a recognized vulnerability name and has no association with the 2014 GNU bash disclosure.

Concept tested: Shellshock bash vulnerability CVE-2014-6271

Source: https://nvd.nist.gov/vuln/detail/CVE-2014-6271

Topics

#Shellshock#bash vulnerability#remote code execution#CVE-2014-6271

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice