The Internet is grappling with another major security vulnerability. According to the Red Hat security blog, the Bash Unix shell is vulnerable to code injection attacks. Dubbed Shellshock, this flaw is severe enough that the Department of Homeland Security's Computer Emergency Readiness Team has issued an alert advising users running Linux and OS X to patch their systems.
The National Vulnerability Database rates the flaw as a 10/10 for impact and exploitability. More worryingly, perhaps, Shellshock apparently has "low" access complexity and no authentication requirements. A cybersecurity expert quoted by Reuters claims "you can just cut and paste a line of code and get good results."
Additional details are available in this blog post by software developer Troy Hunt—and the outlook is pretty grim. Hunt describes the bug's potential as "almost limitless" and "readily automatable." He also worries that Shellshock could be exploited by a worm that propagates quickly, before affected systems can be patched.
"About 25 years' worth of Bash versions" are affected, Hunt says, and the vulnerability extends beyond traditional computers. Even Internet of Things devices may be exploitable, since many run "embedded Linux distributions with Bash." Machines running Windows-based operating systems seem to be safe, at least. Thanks to TR reader Carl for the tip.
|G.Skill's DDR4-4400 kit seizes the four-module memory speed crown||9|
|Rumor: December Radeon drivers will bring a performance OSD||13|
|Intel spins up new assembly-and-test site for Coffee Lake CPUs||8|
|Deal of the day: A laptop with an i5-8250U and Pascal graphics for $680||25|
|EVGA DG-7 cases cover every base||19|
|Radeon 17.11.2 drivers take the fight to the Galactic Empire||36|
|Intel readies a family of 5G modems and talks up a storm on 28 GHz||24|
|National Fast Food Day Shortbread||19|
|OnePlus 5T stretches its screen without straining wallets||40|
|The amount of flak EA are catching for the microtransaction BS is just glorious. I doubt it'll amount to anything but EA are being investigated by the...||+22|