Bash vulnerability allows code execution, may be worse than Heartbleed bug


— 9:20 AM on September 25, 2014

The Internet is grappling with another major security vulnerability. According to the Red Hat security blog, the Bash Unix shell is vulnerable to code injection attacks. Dubbed Shellshock, this flaw is severe enough that the Department of Homeland Security's Computer Emergency Readiness Team has issued an alert advising users running Linux and OS X to patch their systems.

The National Vulnerability Database rates the flaw as a 10/10 for impact and exploitability. More worryingly, perhaps, Shellshock apparently has "low" access complexity and no authentication requirements. A cybersecurity expert quoted by Reuters claims "you can just cut and paste a line of code and get good results."

Additional details are available in this blog post by software developer Troy Hunt—and the outlook is pretty grim. Hunt describes the bug's potential as "almost limitless" and "readily automatable." He also worries that Shellshock could be exploited by a worm that propagates quickly, before affected systems can be patched.

"About 25 years' worth of Bash versions" are affected, Hunt says, and the vulnerability extends beyond traditional computers. Even Internet of Things devices may be exploitable, since many run "embedded Linux distributions with Bash." Machines running Windows-based operating systems seem to be safe, at least. Thanks to TR reader Carl for the tip.

Like what we're doing? Pay what you want to support TR and get nifty extra features.
Top contributors
1. BIF - $340 2. Ryu Connor - $250 3. mbutrovich - $250
4. YetAnotherGeek2 - $200 5. End User - $150 6. Captain Ned - $100
7. Anonymous Gerbil - $100 8. Bill Door - $100 9. ericfulmer - $100
10. dkanter - $100
   
Register
Tip: You can use the A/Z keys to walk threads.
View options

This discussion is now closed.