Concerning the Shellshock bug (aka "bash bug", CVE-2014-6271), can someone explain how this vulnerability works? Based on the test given in some posts (below), it looks like some type of injection using environment variables, but what exactly is occurring/not occurring to keep this from happening?

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
  • Do any of these question's answers help?
    – Ramhound
    Sep 25 '14 at 15:16
  • 1
    +1000 self-awarded stackexhange shame points. I was wondering why SuperUser and ServerFault were a bit light on the topic. Should I keep the question around or delete it? Sec covers it well but different sites have different perspectives in answering sometimes?
    – FLGMwt
    Sep 25 '14 at 15:25
  • 1
    You want an honest answer? If you already found your answer, go vote that question and answer up, and delete this question.
    – Ramhound
    Sep 25 '14 at 15:31
  • @Ramhound I agree, but maybe keeping this one will allow us to close the inevitable flood of others headed our way as duplicates. Sep 25 '14 at 15:35
  • 1
    @Raystafarian: I see no reason for this to be off-topic here. Although security-oriented, it is specific to a particular application (Bash in this case) and computer software is explicitly on-topic for Super User. In fact, we could really use a canonical question and answer describing Shellshock, so I've tagged it [community-faq-proposed].
    – bwDraco
    Sep 27 '14 at 7:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.