Home Nope! Apple’s Patch Doesn’t Fully Fix The Shellshock Bug Either

Nope! Apple’s Patch Doesn’t Fully Fix The Shellshock Bug Either

Get used to reading about the bash “Shellshock” bug, because we won’t be rid of it for a while. The fix Apple released to patch it is incomplete, security researchers said.

See also: Apple Addresses Bash Bug With New Patch

Shellshock, a bug that allows hackers to control a system remotely by inserting commands directly into variables, is a lot bigger than we originally thought. Google security researcher Michal “lcamtuf” Zalewski has found six vulnerabilities associated with the bug.

Previously, Apple thought two Shellshock vulnerabilities were associated with the bash versions running by default on OS X Mavericks, Mountain Lion, Lion, and Lion Server—CVE-2014-7169 and CVE-2014-6271.

However, security researcher Greg Wiseman told CNet that he’s found a third. He ran a script on OS Mountain Lion and found that it’s vulnerable to CVE-2014-7186, a vulnerability that allows attackers to remotely create denial of service attacks.

Wiseman did not say he’d found the vulnerability on systems other than Mountain Lion, but if you want to be sure about your system, you can clone Hanno Böck’s bashcheck testing script from GitHub, the same one Wiseman used for his trials.

See also: New Security Flaws Render Shellshock Patch Ineffective

Apple has maintained that the “vast majority of users” are not susceptible to the bug, only those who have customized their advanced Unix settings. Unless that’s you, it might be preferable to sit tight. With a new patch coming out—and then being found lacking—so many days in a row, it’s clear there’s only so much we can fix on our own.

Photo by Adair733

About ReadWrite’s Editorial Process

The ReadWrite Editorial policy involves closely monitoring the tech industry for major developments, new product launches, AI breakthroughs, video game releases and other newsworthy events. Editors assign relevant stories to staff writers or freelance contributors with expertise in each particular topic area. Before publication, articles go through a rigorous round of editing for accuracy, clarity, and to ensure adherence to ReadWrite's style guidelines.

Get the biggest tech headlines of the day delivered to your inbox

    By signing up, you agree to our Terms and Privacy Policy. Unsubscribe anytime.

    Tech News

    Explore the latest in tech with our Tech News. We cut through the noise for concise, relevant updates, keeping you informed about the rapidly evolving tech landscape with curated content that separates signal from noise.

    In-Depth Tech Stories

    Explore tech impact in In-Depth Stories. Narrative data journalism offers comprehensive analyses, revealing stories behind data. Understand industry trends for a deeper perspective on tech's intricate relationships with society.

    Expert Reviews

    Empower decisions with Expert Reviews, merging industry expertise and insightful analysis. Delve into tech intricacies, get the best deals, and stay ahead with our trustworthy guide to navigating the ever-changing tech market.