The Internet is grappling with another major security vulnerability. According to the Red Hat security blog, the Bash Unix shell is vulnerable to code injection attacks. Dubbed Shellshock, this flaw is severe enough that the Department of Homeland Security's Computer Emergency Readiness Team has issued an alert advising users running Linux and OS X to patch their systems.
The National Vulnerability Database rates the flaw as a 10/10 for impact and exploitability. More worryingly, perhaps, Shellshock apparently has "low" access complexity and no authentication requirements. A cybersecurity expert quoted by Reuters claims "you can just cut and paste a line of code and get good results."
Additional details are available in this blog post by software developer Troy Hunt—and the outlook is pretty grim. Hunt describes the bug's potential as "almost limitless" and "readily automatable." He also worries that Shellshock could be exploited by a worm that propagates quickly, before affected systems can be patched.
"About 25 years' worth of Bash versions" are affected, Hunt says, and the vulnerability extends beyond traditional computers. Even Internet of Things devices may be exploitable, since many run "embedded Linux distributions with Bash." Machines running Windows-based operating systems seem to be safe, at least. Thanks to TR reader Carl for the tip.
|1. BIF - $340||2. Ryu Connor - $250||3. mbutrovich - $250|
|4. YetAnotherGeek2 - $200||5. End User - $150||6. Captain Ned - $100|
|7. Anonymous Gerbil - $100||8. Bill Door - $100||9. ericfulmer - $100|
|10. dkanter - $100|
|Nanoxia Project S case slides into home-theater setups||12|
|Nvidia previews Xavier SoC with Volta GPU for self-driving cars||12|
|be quiet! Silent Loop AIO liquid coolers hum along quietly||2|
|Microsoft catapults datacenter performance with FPGAs||37|
|Asus J3455M-E mobo sails out with Apollo Lake SoC aboard||18|
|AOC's Agon family of gaming monitors heads stateside||15|
|Google Data Saver improves mobile browsing on narrow pipes||8|
|Toshiba expands its budget SSD lineup with its OCZ TL100||13|
|Rumor: Nvidia and Apple may reunite for future Mac GPUs||29|