"Shellshock" bash bug

[Nick T.]

Do we know what the attack surface for desktop computers is?
I know that DHCP is vulnerable and can give root access to a rogue DHCP 
server but how about the internet facing programs(firefox,chrome, 
thunderbird etc) do such programs invoke bash environment variables?

~ Nick


On 26/09/2014 06:43 μμ, Kevin O'Gorman wrote:
> There has been a code-injection vulnerability in bash for the last 22 
> years, recently discovered and named "Shellshock".  It's nasty. 
> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271
>
> Here's a quick one-liner to see if you're vulnerable:
> $ env x='() { :;}; echo vulnerable'  bash -c "echo this is a test"
> vulnerable
> this is a test
> $
>
> If you get that result, update your bash from the repositories, and 
> all should be well:
> $ env x='() { :;}; echo vulnerable'  bash -c "echo this is a test"
> bash: warning: x: ignoring function definition attempt
> bash: error importing function definition for `x'
> this is a test
> $
>
> Safe computing to all
>
>
> -- 
> Kevin O'Gorman
> #define QUESTION ((bb) || (!b))  /* Shakespeare */
>
> 	Please consider the environment before printing this email.
>
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/ubuntu-users/attachments/20140926/bbbac5b8/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/gif
Size: 441 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/ubuntu-users/attachments/20140926/bbbac5b8/attachment.gif>