Shellshock is a bug that uses a vulnerability in the common Unix command execution shellbash (Bourne-Again SHell) to potentially enable hackers to take control of the machine and remotely execute arbitrary code directly into the system.
Because it preys on the Unix bash shell, which is utilized by most other major desktop and mobile operating systems like Linux, Mac OS X, iOS, Google Android and even Microsoft Windows, Shellshock has the potential to attack many types of systems and devices. To date, though, reports of Shellshock in the wild have been fairly limited, with the most prominent attacks targeting Web-facing servers and Network-Attached Storage devices (NAS).
It's also believed that operating systems like OS X and Windows do not expose bash to attacker-supplied input, which Shellshock would need to be able to control the computer. There remains the possibility, though, that other vulnerabilities could be discovered that would provide a way into the system for Shellshock or variants of the Shellshock bug.
Shellshock Shares Similarities with Heartbleed
Shellshock shares similarities with the Heartbleed bug that gained widespread attention in early 2014. Both are examples of arbitrary code execution (ACE) vulnerabilities, and they both make it possible for a hacker to exploit a wide range of computers, servers and other devices.
Shellshock Bug a Perfect 10 in Severity
The National Institute of Standards and Technology has rated the Shellshock vulnerability as a 10 out of 10 in terms of severity, impact and exploitability. Compounding the problem, Shellshock is also ranked low on the complexity scale, which means it has the potential to easily be used by a large percentage of hackers.
Stay up to date on the latest developments in Internet terminology with a free weekly newsletter from Webopedia. Join to subscribe now.
Like everything in technology, AI touches on so many other trends, like self-driving cars and automation, and Big Data and the Internet of Things... Read More »DevOp's Role in Application Security
As organizations rush to release new applications, security appears to be getting short shrift. DevSecOps is a new approach that holds promise. Read More »Slideshow: Easy Editorial SEO Tips to Boost Traffic
This slideshow reviews five easy on-page editorial SEO tips to help drive organic search engine traffic, including the page title, heading,... Read More »
Java is a high-level programming language. This guide describes the basics of Java, providing an overview of syntax, variables, data types and... Read More »Java Basics, Part 2
This second Study Guide describes the basics of Java, providing an overview of operators, modifiers and control Structures. Read More »The 7 Layers of the OSI Model
The Open System Interconnection (OSI) model defines a networking framework to implement protocols in seven layers. Use this handy guide to compare... Read More »