[Utilizer]

More info at link, including unofficial patch link and another for technical analysis. Anyone familiar with the Shellshock vulnerability previously noted in this forum and the Bash CLI should at least glance at this.

(Note that the timestamp is in the Australian timezone)

[Daffynition]

Meanwhile in Detroit.

[mc5cents]

[ConservingFreedom]

Oy vey!

“At first sight, the potential for remote exploitation should be limited to CGI scripts that start with #!/bin/bash and to several other programs that explicitly request this particular shell. But there’s a catch: on a good majority of modern Linux systems, /bin/sh is actually a symlink to /bin/bash!

“This means that web apps written in languages such as PHP, Python, C++, or Java, are likely to be vulnerable if they ever use libcalls such as popen() or system(), all of which are backed by calls to /bin/sh -c ‘...’. There is also some added web-level exposure through #!/bin/sh CGI scripts, <!—#exec cmd=”...”> calls in SSI, and possibly more exotic vectors such as mod_ext_filter.

“For the same reason, userland DHCP clients that invoke configuration scripts and use variables to pass down config details are at risk when exposed to rogue servers (e.g., on open wifi). A handful of MTAs, MUAs, or FTP server architectures may be also of concern - in particular, there are third-party reports of qmail installations being at risk.”

[Utilizer]

ping...

[ShadowAce]

[RayChuang88]

However, given that the bash shell is written in Open Source (after all, it is part of UNIX), more complex fixes will probably be out within the next few days anyway. The likes of Red Hat and Canonical probably know how to implement these fixes, too.

[molson209]

Sloppy Web Site builders making it crap for everyone

[Amendment10]

I understand that one of the machines at work has bash, and probably most Macs do.

But I also understand that if users haven’t changed the default security settings of their machines, and many (most?) users probably haven’t, then you’ve still got safety nets.

Insights welcome.

[Proud_texan]

I looked about and couldn’t find any info but I was wondering how the Shellshock situation came about in the first place. Was it just bad/sloppy coding/design, a problem with the compiler, or something else?