The US government-backed
National Vulnerability Database rated Shellshock 10/10 for severity.
[...]
In theory, an attacker could exploit a machine running Bash by forcing it to set specially crafted environment variables. This could then be further exploited to let them execute shell commands, ie run programs on other people’s computers. That’s endgame for the victims - their machines would in effect be in the control of the hacker.
In slightly more detail, when dealing with environment variables, Bash shouldn’t continue to process commands that come after the “function definition” - the declaration of a software routine that performs a certain task. But it does and therefore allows for an outsider to send exploit code via software that uses Bash and have it run commands. They should never be able to do that.
For instance, the widely deployed Apache web server software has Bash run in the background to parse CGI scripts - little programs that process data from web users, such as when they enter information into a form. As there’s no authentication on these CGI scripts, a hacker could call them with a web request and include lines of exploit code, which would then set malicious variables on the server via Bash. From there, they could play with programs on the server, including the website itself to launch further attacks on visitors, hence the fear of widespread impact. This is believed to be the most likely attack vector.
[...]
“What we think will cause significant issues is that people will find plenty of unexpected ways to trigger this vulnerability and that means its scope will be wider than appreciated, and this might have a detrimental impact,” Robert Horton, managing director of NCC Group’s European Security Consulting division, told the Guardian.
“A lot of systems do appear to be remotely vulnerable to this which means the impact of this has the potential to be large and much more pervasive than
Heartbleed.”
One of the major worries is that attackers will use Shellshock to create worms – attacks that automatically replicate across machines. “In theory, this could take the form of an infected machine scanning for other targets and propagating the attack to them,” noted security expert Troy Hunt. “This would be by no means limited to public-facing machines either; get this behind the corporate firewall and the sky’s the limit.”
Zas! Cazado! El mail no era de Segudamano y la web no era la original (pero idéntica en aspecto)
