Ars Technica reports Bug in Bash shell creates big security hole on anything with *nix in it. "The bug, discovered by Stephane Schazelas, is related to how Bash processes environmental variables passed by the operating system or by a program calling a Bash-based script. If Bash has been configured as the default system shell, it can be used by network–based attackers against servers and other Unix and Linux devices via Web requests, secure shell, telnet sessions, or other programs that use Bash to execute scripts."
"The vulnerability affects versions 1.14 through 4.3 of GNU Bash."
As Errata Security explains, Bash bug as big as Heartbleed. "Unlike Heartbleed, which only affected a specific version of OpenSSL, this bash bug has been around for a long, long time. That means there are lots of old devices on the network vulnerable to this bug. The number of systems needing to be patched, but which won't be, is much larger than Heartbleed."
Update: Troy Hunt: Everything you need to know about the Shellshock Bash bug
No comments:
Post a Comment