Shellshock Exploits in the Wild

Summary: Cisco Talos reported that exploitation attempts against the Bash vulnerability CVE-2014-6271 were detectable in its IPS telemetry as early as Wednesday 24 September 04:00 GMT, peaked on Friday 26 September 04:00 GMT, tailed off over the weekend, and spiked again on Sunday 28 September 16:00 GMT. Shodan data cited in the post showed 3,515 devices vulnerable to Shellshock on port 80, against more than 530,000 devices identified as susceptible to Heartbleed shortly after that vulnerability was found.
What you should know: Shellshock can compromise a device with a single request, unlike Heartbleed, which required many malicious requests to maximize collection of exposed memory - and the 3,515 port-80 figure likely understates true exposure because the flaw affects many ports beyond 80.

Read the original at Cisco Talos ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2014-6271
Related: CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Jan 28, 2022
Another Major Vulnerability Bashes Systems Cyber Risks ·
Shellshock - Update Bash Immediately! Cyber Risks ·