Bash ‘Shell Shock’ bug blasts OS X, Linux systems wide open

A bug discovered in the widely used Bash command interpreter poses a critical security risk to Unix and Linux systems – and, thanks to their ubiquity, the internet at large.

It lands countless websites, servers, PCs, OS X Macs, various home routers, and more, in danger of hijacking by hackers.

The vulnerability is present in Bash up to and including version 4.3, and was discovered by Stephane Chazelas. It puts Apache web servers, in particular, at risk of compromise: CGI scripts that use or invoke Bash in any way – including any child processes spawned by the scripts – are vulnerable to remote-code injection. OpenSSH and some DHCP clients are also affected on machines that use Bash.

Ubuntu and other Debian-derived systems that use Dash exclusively are not at risk – Dash isn’t vulnerable, but busted versions of Bash may well be present on the systems anyway. It’s essential you check the shell interpreters you’re using, and any Bash packages you have installed, and patch if necessary.

Security expert Kenn White tweeted:

You can check if you’re vulnerable by running the following lines in your default shell, which on many systems will be Bash. If you see the words “busted”, then you’re at risk. If not, then either your Bash is fixed or your shell is using another interpreter.

env X="() { :;} ; echo busted" /bin/sh -c "echo completed"
env X="() { :;} ; echo busted" `which bash` -c "echo completed"

According to the NIST vulnerability database, which rates the flaw 10 out of 10 in terms of severity:

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.

Authentication: Not required to exploit

Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

An advisory from Akamai explains the problem in more depth, as does this OSS-Sec mailing list post.

Ars Technica ran an in-house test on the latest Mac OS Mavericks, and found that it was indeed vulnerable at that point.  Bash is also used by some web servers, meaning that individual websites could be affected.

The National Vulnerability Database, which catalogues known security issues and which is sponsored by the US Department of Homeland Security, has ranked the impact of the bug at the maximum score of 10. They also measured its exploit ability—how effectively the bug can be used to gain access to systems—at 10.

Everything you need to know about the Shellshock Bash bug

Thursday, September 25, 2014

Remember Heartbleed? If you believe the hype today, Shellshock is in that league and with an equally awesome name albeit bereft of a cool logo (someone in the marketing department of these vulns needs to get on that). But in all seriousness, it does have the potential to be a biggie and as I did with Heartbleed, I wanted to put together something definitive both for me to get to grips with the situation and for others to dissect the hype from the true underlying risk.

To set the scene, let me share some content from Robert Graham’s blog post who has been doing some excellent analysis on this. Imagine an HTTP request like this:

target =
 port = 80
 banners = true
 http-user-agent = shellshock-scan (
 http-header = Cookie:() { :; }; ping -c 3
 http-header = Host:() { :; }; ping -c 3
 http-header = Referer:() { :; }; ping -c 3

CVE-2014-6271: remote code execution through bash

From: Florian Weimer
Date: Wed, 24 Sep 2014 16:05:51 +0200

Stephane Chazelas discovered a vulnerability in bash, related to how
environment variables are processed: trailing code in function
definitions was executed, independent of the variable name.

In many common configurations, this vulnerability is exploitable over
the network.

Chet Ramey, the GNU bash upstream maintainer, will soon release
official upstream patches.


Share your thoughts

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s