shellshock

Shellshock is a family of security vulnerabilities discovered in the Unix Bash shell in 2014. The flaws allow remote code execution by supplying specially crafted environment variables to Bash processes, potentially giving attackers control over affected systems. The vulnerability was named 'Shellshock' due to the ability to execute arbitrary code through the shell by injecting function definitions into environment variables.

Technical details: The core issue involved how Bash parsed environment variables containing function definitions. When a Bash process exported the environment to child processes, an attacker could define a function in the environment and then trigger execution of arbitrary commands. The initial vulnerability was tracked as CVE-2014-6271, with related issues (CVE-2014-7169, CVE-2014-6277, CVE-2014-6278) that expanded the scope. Patches were released by the GNU Project and major distributions.

Impact and scope: Bash is widely used on Linux and other Unix-like systems. Any service that relies on Bash to process environment variables, especially CGI scripts, web servers, and SSH gateways, could be exploited. The vulnerability was quickly exploited in the wild, prompting rapid patch deployments across platforms. While many environments were affected, Windows systems were unaffected unless Bash was installed via third-party environments such as Cygwin or Windows Subsystem for Linux.

Mitigation and response: System administrators were advised to upgrade Bash to patched versions and to restart affected services. In some setups, reducing or isolating environment variable transmission to shells, disabling CGI scripts invoking Bash, or reconfiguring web servers could mitigate risk. Ongoing patches and subsequent advisories refined the fixes to address related issues discovered after the initial disclosure.

Legacy and significance: Shellshock is considered one of the most serious and widespread Unix vulnerabilities in recent years, highlighting the risks of remotely accessible services that invoke shell environments and the importance of timely software updates and defense-in-depth configurations.