Linux users got a nasty surprise today, as a security team at Red Hat uncovered a subtle but dangerous bug in the Bash shell, one of the most versatile and widely used utilities in Linux. It’s being called the Bash bug, or Shellshock. When accessed properly, the bug allows for an attacker’s code to be executed as soon as the shell is invoked, leaving the door open for a wide variety of attacks. Worse yet, it appears the bug has been present in enterprise Linux software for a long time, so patching every instance may be easier said than done. Red Hat and Fedora have already released patches for the bug. The bug also affects OS X, and while the company has yet to release an official fix, this Stack Exchange post contains details on how Mac users can check for the vulnerability and patch it once identified.
Must check : How to create password protected folders on Linux
What makes this particular bug problematic is the fact that Bash is the default shell in Mac OS X and many Linux machines, meaning it’s also used in many web servers. I’ve tested Bash on my own MacBook Air, and sure enough, it is vulnerable (see the image above).
Much worse is the fact that a lot of applications invoke Bash for many different reasons, opening the path for a number of different ways to exploit this vulnerability.
Red Hat’s security team, which first found the vulnerability,explains this: “This issue affects all products which use the Bash shell and parse values of environment variables. This issue is especially dangerous as there are many possible ways Bash can be called by an application. Quite often if an application executes another binary, Bash is invoked to accomplish this. Because of the pervasive use of the Bash shell, this issue is quite serious and should be treated as such.”
Unlike Heartbleed, which forced users to change their passwords for various Internet services, Shellshock doesn’t appear to have any easy solutions for average users right now. In most cases, it will be up to system administrators and software companies to issue patches.
Source : theverge & mashable