Vulnerabilidade no Bash é muito grave

[Winjer]

Bash vulnerability allows code execution, may be worse than Heartbleed bug

The Internet is grappling with another major security vulnerability. According to the Red Hat security blog, the Bash Unix shell is vulnerable to code injection attacks. Dubbed Shellshock, this flaw is severe enough that the Department of Homeland Security's Computer Emergency Readiness Team has issued an alert advising users running Linux and OS X to patch their systems.The National Vulnerability Database rates the flaw as a 10/10 for impact and exploitability. More worryingly, perhaps, Shellshock apparently has "low" access complexity and no authentication requirements. A cybersecurity expert quoted by Reuters claims "you can just cut and paste a line of code and get good results."
Additional details are available in this blog post by software developer Troy Hunt—and the outlook is pretty grim. Hunt describes the bug's potential as "almost limitless" and "readily automatable." He also worries that Shellshock could be exploited by a worm that propagates quickly, before affected systems can be patched.

"About 25 years' worth of Bash versions" are affected, Hunt says, and the vulnerability extends beyond traditional computers. Even Internet of Things devices may be exploitable, since many run "embedded Linux distributions with Bash." Machines running Windows-based operating systems seem to be safe, at least.

A maior parte dos utilizadores comuns não usam sistemas baseados em Unix, mas existem muitas grandes empresas e estados que usam e que ficam expostas.

[Dape_1904]

O Unix não é muito explorado, porque isto é só um arranhão na superfície do iceberg...

[Filipe]

QNAP Releases Qfix 1.0.1 to Path GNU Bash Vulnerability

Redhat - Solution

Ubuntu - Solution