Bash Shellshock vulnerability

Post Reply New Topic

"Heartbleed" was bad, but "Shellshock" is, arguably, worse!

https://community.qualys.com/blogs/laws ... nerability

Apparently it was introduced 22 years ago in version 1.13! I know it's a complex piece of software and all, but the bug is not complex to exploit. It's hard to believe that nobody would have come across it, even by pure chance, in all that time or that nobody realised the implications when they did!

^ It has probably been used extensively for many years by the likes of the NSA/CIA as one of the many flaws enabling them to hack into computers world wide.

Btw the updates/patches shouldn't be treated a as complete solution. Further update may be forthcoming.

It is also worth updating bash individually to make sure.

Run this test

I hope this bug has long-lasting implications on security design. Years from now, I see them teaching in computer security classes "... and this is another subtle example of mixing data (variable values) and code (functions)... it's not a problem - until it is!" I'm sure there are many lessons from this. None of them are actually new, but this might help to drive them home.