Shellshock - Update Bash Immediately!

Summary: Bash, the widely distributed Linux shell, fails to correctly parse environment variables containing function declarations, so a variable beginning with "() {" is passed without sanitation to parse_and_execute(), which runs every command in the string rather than stopping at the end of the function definition. Cisco Talos reports that the original fix for CVE-2014-6271 was incomplete (CVE-2014-7169), that attacks have been observed loading ELF binaries onto possibly vulnerable targets via wget, and that ClamAV detects the threat as "Linux.Flooder.Agent".
Bottom line: The flaw is reachable through programs that set environment variables from network data - dhcpcd via DHCP option 114, and Apache's mod_cgi or mod_cgid when CGI scripts are written in Bash or spawn subshells with exported untrusted data - so command injection can arrive over ordinary network traffic. The first patch did not close it, and attackers are already using it to pull ELF binaries onto targets.

Read the original at Cisco Talos ↗

Topics: Malware
Mentions: CVE-2014-6271 CVE-2014-7169
Related: CVE-2014-6271: Mitigating the Bash Shellshock Exploit | Qualys Cyber Risks ·
CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Jan 28, 2022
CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Known Exploited Vulnerabilities · Jan 28, 2022