Shellshock is a newly discovered security flaw that has been around for 22 years, and works by exploiting the very nature of web GUI.
Working in the same way as SQL injection, Shellshock allows users to insert Bash (a Unix-based command processor, or shell) commands into a server via a web form or similar method, and exploits the very nature of environment variable handling, which is that after assigning a function to a variable, any trailing code in the function will be then executed.
Where the SQL injection vulnerability allows a hacker access to the database, Shellshock gives the hacker an authentication-free access to the server, which makes it much more powerful. With this type of access, one with malicious intent could create a worm that could multiply and reproduce the exploit across entire networks to collect or modify data, or open other security holes that would otherwise be closed. Though Bash does not natively run on Microsoft Windows machines, it can be ported, but it is not yet known if the vulnerability will remain present.
Ok, so I get it, itâs dangerous. Am I vulnerable?
Absolutely.
Why?
Because Unix has a much wider grip on our networks than most people can really appreciate. Due to its ubiquity, everything from routers and smartphones, TVs, cars and more could be exploited. Worse, is that many of those devices are very difficult to update. Your home router, for example, has control of all your incoming and outgoing network traffic, and if someone has that, not only do they have the potential to collect your data, but to enable ports, disable the firewall, and further their access into your network infrastructure. With that being said, if you are running any versions of Unix or Mac, and havenât familiarized yourself with this vulnerability, youâre well overdue.
Luckily, many vendors have now patched for Shellshock by updating Bash, but at this time, Apple users should wait for an update.
Iâm running Unix. What do I do now?
First, itâs best to find out if youâre affected. Specifically, are you running Redhat, Ubuntu, Fedora, CentOS (v5-7) CloudLinux, or Debian? If so, then run this command to find out if youâre vulnerable.
$ env x=’() { :;}; echo vulnerable’ bash -c “echo this is a test”
If you see nothing but âthis is a test,â youâve successfully run the exploit, and youâve got some work to do.
Luckily, most Linux distributions have issued fixes, so you can simply run your update manager. For those who havenât, you can do so manually by running the following commands:
yum update bash
OR
sudo apt-get update && sudo apt-get install bash
Help, I have a Mac!
Are you infected? Run this command from your shell and find out.
$ env x=’() { :;}; echo vulnerable’ bash -c ‘echo hello’
If youâve got Mac machines in your environment that can be exploited, you can disable the exploit by temporarily changing the default user shell. For IT administrators that have the know-how, get started right away – but for those that have to ask âhow?,â itâs best to keep your eyes peeled and wait for an official update from Apple.
Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news, fun and contest information, please follow us on Facebook, Twitter and Google+. Business owners â check out our business products.