Editing Bash (Unix shell) (section)

=== Shellshock ===
In September 2014, a [[security bug]] was discovered<ref>{{Cite news |last=Juliana     |first=Cino     |date=10 June 2017     |title=Linux bash exit status and how to set exit status in bash - Techolac     |url=https://www.techolac.com/linux/linux-bash-exit-status-and-how-to-set-exit-status-in-bash/     |url-status=live   |archive-url=https://web.archive.org/web/20190621183753/https://www.techolac.com/linux/linux-bash-exit-status-and-how-to-set-exit-status-in-bash/     |archive-date=June 21, 2019     |access-date=21 June 2019    }}</ref> in the program. It was dubbed "[[Shellshock (software bug)|Shellshock]]." Public disclosure quickly led to a range of [[Attack (computing)|attacks]] across the [[Internet]].<ref name="TR-20140924">{{Cite web |last=Leyden     |first=John     |date=September 24, 2014     |title=Patch Bash NOW: 'Shell Shock' bug blasts OS X, Linux systems wide open     |url=https://www.theregister.co.uk/2014/09/24/bash_shell_vuln/     |url-status=live     |archive-url=https://web.archive.org/web/20141016214010/http://www.theregister.co.uk/2014/09/24/bash_shell_vuln     |archive-date=October 16, 2014     |access-date=September 25, 2014     |website=[[The Register]]  }}</ref><ref name="NYT-20140925-NP">{{Cite news |last=Perlroth     |first=Nicole     |date=September 25, 2014     |title=Security Experts Expect 'Shellshock' Software Bug in Bash to Be Significant     |url=https://www.nytimes.com/2014/09/26/technology/security-experts-expect-shellshock-software-bug-to-be-significant.html     |url-status=live     |archive-url=https://web.archive.org/web/20190405000511/https://www.nytimes.com/2014/09/26/technology/security-experts-expect-shellshock-software-bug-to-be-significant.html     |archive-date=April 5, 2019     |access-date=September 25, 2014     |work=[[The New York Times]]  }}</ref><ref name="ZDN-20140929">{{Cite web |last=Seltzer     |first=Larry     |date=29 September 2014     |title=Shellshock makes Heartbleed look insignificant     |url=https://www.zdnet.com/article/shellshock-makes-heartbleed-look-insignificant/     |url-status=live     |archive-url=https://web.archive.org/web/20160514191755/http://www.zdnet.com/article/hackers-jump-on-the-shellshock-bash-bandwagon/     |archive-date=May 14, 2016     |website=[[ZDNet]]  }}</ref>

Exploitation of the vulnerability could enable [[arbitrary code execution]] in [[Common Gateway Interface|CGI]] scripts executable by certain versions of Bash. The bug involved how Bash passed function definitions to subshells through [[environment variable]]s.<ref>{{Cite web |last=Huzaifa Sidhpurwala     |date=2014-09-24     |title=Bash specially-crafted environment variables code injection attack     |url=https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/     |url-status=live |archive-url=https://web.archive.org/web/20140925035842/https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/     |archive-date=September 25, 2014     |access-date=September 25, 2014     |publisher=[[Red Hat]]    }}</ref> The bug had been present in the [[source code]] since August 1989 (version 1.03)<ref name="Seclists-20141004">{{Cite web |last=Chazelas     |first=Stephane     |date=4 October 2014     |title=oss-sec mailing list archives     |url=http://seclists.org/oss-sec/2014/q4/102     |url-status=live     |archive-url=https://web.archive.org/web/20141006093452/http://seclists.org/oss-sec/2014/q4/102     |archive-date=October 6, 2014     |access-date=4 October 2014     |website=Seclists.org  }}</ref> and was patched in September 2014 (version 4.3).

Patches to fix the bugs were made available soon after the bugs were identified. Upgrading to a current version is strongly advised.

It was assigned the [[Common Vulnerabilities and Exposures|Common Vulnerability]] identifiers {{
  CVE
    | 2014-6271
    | 2014-6277
    | 2014-7169
    | leadout=and
    | link=no
}}, among others. Under CVSS Metrics 2.x and 3.x, the bug is regarded as "high" and "critical", respectively.