The Shell Shock security flaw could be bigger than Heartbleed.

A serious security flaw recently discovered in the Bash command-line shell application has been nicknamed “Shell Shock”.

Bash, an acronym for Bourne Again Shell, is a command-line shell application that allows users to issue commands to launch programs, features and make changes by typing text into a console. It’s typically used by programmers and server administrators when making changes to their servers. Bash usually isn’t open to the general public nor made available to access over the Internet by unauthorised users, but Shell Shock changes that.

This isn’t a new vulnerability (although it’s only just been discovered),  in fact it’s been around for 20-25 years. It allows the user to manipulate “environment variables” to influence how the software responds and ultimately exploit the machine it is running on.

According to the National Institute of Standards and Technology this bug is rated a 10/10 in terms of severity:

NU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.

 

Authentication: Not required to exploit

 

Impact Type: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

Ultimately, the message of this blog post is to get your systems updated and patched immediately. This is a critical flaw in the security of a lot of servers around the world and failing to act could leave you open to data breaches.

All Consider IT Clients can rest safe in the knowledge that, as ever, we have already taken actions to mitigate this huge risk.