In past few days, you must have heard about the term "Shellshock". This is the vulnerability also known as Bash which is a Unix shell. Previously few months back heartbleed vulnerability was found, and it is claimed that Shellshock vulnerability may be stronger or say larger than it. What the heck is Shellshock vulnerability? Lets find it out.

Firstly let's know Bash

First of lets talk about Bash. Bash is a software which is used by millions of devices and computers, so if any vulnerability is found in this software, then it is surely possible that a large number of possibilities for attacks be available.

Now lets talk about Unix, which is an operating system which is widely used. Unix is used widely in servers, modems, security camera's and lot of devices. And Bash is a Unix shell which is called a terminal emulator.

Now, lets checkout what is the vulnerability. Bash is a text-only so its great to access computer remotely. If there is any vulnerability fund in bash then the amount of threat increases a lot to your system. The bugs that are mainly found are from Bash handles which are also known as "environmental variables". If you attacker finds any vulnerability in the bash then the attacking threat to a devices increases.

So, what exactly is Shellshock?

So, basically what Shellshock is vulnerability in Bash, which is a software used by millions of users around the world. This opens possibilities for attack arbitrary commands on any machine running it.

Major Threat

About 50% of web servers use Apache, which concludes that there may be some version of Bash in them. So, it means a lot and lot of systems are around the world are under threat of this vulnerability attack.

Many people are thinking Bash as a command line, which is not true. It is the command interpreter widely used across the globe.

What's The vulnerability?

The major problem or vulnerability is that a major problem occurs when specific characters are included as part of a variable definition.

For example, if a character ":{;}" are included as the function, if any arbitrary code is inserted after this definition is processed. Which is not supposed to be the result.

CGI and Apache have access to Bash which they can use in background due to which this problem has been exacerbated. So, basically if the access to the command line is provided then hackers will get access to entire environment.

What are Versions of Bash Affected?

It is very disheartening to note that basically all the versions after 4.3 of bash have been affected by the attack. That means all installs from previous 25 years have been affected.

Is Windows Safe from Vulnerability?

Basically windows don't have bash installed by default whereas some of the applications and softwares installed in the windows can make your system vulnerable. Regular users of windows are safe as if you have not installed Cygwin or Git or other such programs.

For Linux users, you can check destro for updates about patch of bash.

So, for now the biggest targets coming out are Web Servers. And about 50% of internet is at risk with this vulnerability.

So, now at last question arises how dangerous can be this vulnerability and what would be the range of destruction by this vulnerability.