OS2 World Community Forum

OS/2, eCS & ArcaOS - Technical => Programming => Topic started by: Ian Manners on September 25, 2014, 09:28:05 am

Title: Remote Exploit Vulnerability Found In Bash
Post by: Ian Manners on September 25, 2014, 09:28:05 am
http://www.csoonline.com/article/2687265/application-security/remote-exploit-in-bash-cve-2014-6271.html (http://www.csoonline.com/article/2687265/application-security/remote-exploit-in-bash-cve-2014-6271.html)

A remotely exploitable vulnerability has been discovered by Stephane Chazelas in bash on Linux and it is unpleasant. The vulnerability has the CVE identifier CVE-2014-6271 and has been given the name Shellshock by some. This affects Debian as well as other Linux distributions. You will need to patch ASAP.

Bash supports exporting shell variables as well as shell functions to other bash instances. This is accomplished through the process environment to a child process.

The major attack vectors that have been identified in this case are HTTP requests and CGI scripts.