Shellshock - Dangerous Bug For Linux And Mac

Attention all Linux or Mac users, someone might be present inside your system.

Shellshock is the latest bug found which attacks BASH (Bourne Again Shell). It is bigger than Heartbleed which exposed millions of computer's data to hackers.

 It is rated 10 out of 10 on U.S. National Vulnerability Database's severity scale.

Bash:

BASH (Bourne Again Shell) is a software which enables user to control their computer using commands. It allows users to run actions on their computers, like a few codes and words typed in can enable some features or launch some programs.

Shellshock:

Shellshock is a loophole found in Bash using which anyone's code can be processed on your system.

Linux specialist Stephane Schazelas discovered this bug this week, but it existed in the system for atleast 20+ years.

Hackers and Shellshock:

A hacker can use this hole to insert malicious or unwanted code in to victim's computer and run the commands he want. He can also access your data or even modify it.

"Using this vulnerability, attackers can potentially take over the operating system, access confidential information, make changes, et cetera," Tod Beardsley, a manager at cybersecurity firm Rapid7, told Reuters.

Heartbleed opened up massive privacy concerns, but hackers could only spy on computers — not control them, Reuters explained. With Shellshock, information and files on a properly accessed computer could be manipulated, not just watched.

Shellshock is also worse than Heartbleed because it's so simple: an attacker could exploit the flaw with just three lines of code, Wired reported.

Plus, since the flaw has been around for more than two decades, there are a lot of computers susceptible to it.

Testing Vulnerability:

1) Open Bash on your system.

2) Type this line of text into the shell: env x='() { :;}; echo vulnerable' bash -c 'echo hello'

3) If you're not vulnerable, you'll get this result:

bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' hello
If you are vulnerable, you'll get:
vulnerable hello
You can also check the version of bash you're running by entering:
bash --version

Fix:

There is no stable fix available as of now, will update you as soon as one stable fix gets released.

Source: http://www.nydailynews.com/