iPhone XS and XS Max in silver, space gray, and gold.
'Bash' Security Flaw in OS X Allows for Malicious Attacks on Devices and Services
Security researchers from Red Hat have uncovered a new exploit in the common "Bash" command shell found in OS X and Linux which can be used to deploy malicious code with minimal effort. Due to the ubiquity of the Bash shell, the exploit can affect a wide variety of different web-connected devices and properties, including unsecured websites, smart home appliances, servers, and more.
Security researcher Robert Graham noted on his blog that the Bash exploit is "as big as Heartbleed," referring to the flaw discovered earlier this year in the popular OpenSSL software which secures connections between clients and servers:
Internet-of-things devices like video cameras are especially vulnerable because a lot of their software is built from web-enabled bash scripts. Thus, not only are they less likely to be patched, they are more likely to expose the vulnerability to the outside world.Heartbleed was said to have affected 66% of the Internet, although Apple announced in April that the exploit did not affect its software or "key services." Apple also released updates for the AirPort Extreme and Time Capsule to better secure both web devices against Heartbleed.
Unlike Heartbleed, which only affected a specific version of OpenSSL, this bash bug has been around for a long, long time. That means there are lots of old devices on the network vulnerable to this bug. The number of systems needing to be patched, but which won't be, is much larger than Heartbleed.
A topic discussing the Bash exploit on StackExchange also notes that Apple did not include a fix for the bug in its latest round of security updates that came alongside the release of OS X Mavericks 10.9.5 last week. It is possible however that Apple will release a fix for OS X in the near future to address the exploit, similar to what it has done for other security issues in the past.
[ 186 comments ]
Top Rated Comments
(View all)
52 months ago
strike three. you're out...
now what?
*still waiting for iPhone + Apple Watch*
*facepalm* you people don't know what bash is do you. this has nothing to do with apple.
52 months ago
Always interesting to find out that a security bug like this has been around for years and no one knew about it until just now.
If only Bash would have been open source so people could search bugs in the source code
/s
52 months ago
Always interesting to find out that a security bug like this has been around for years and no one knew about it until just now.
52 months ago
No, as far as I have seen so far the first initial patch didn't actually fix the problem. The fact is that the bug was publicly disclosed yesterday, and you are ranting because there is no patch today, as of yet.
The bug is fixed. The patch is available. Apple could have rolled it out by now.
The GNU people even were so nice to backport the fixes to the ancient version Apple is using because Apple doesn't want code that's licensed with GPL v3.
http://ftp.gnu.org/gnu/bash/bash-3.2-patches/bash32-052
Apple just has to apply the patch and provide a new bash binary through software update. Apple does not have to identify the bug, they don't have to come up with a solution, they don't have to verify the fix. Everything is done already.
Stupid politics are the only thing that prevent the release of this bugfix. Probably because they like to bundle patches so people think their software is more secure because it isn't patched that often.
52 months ago
I guess this could be the one time that Microsoft fans can say to OS X and Linux (really any 'NIX) fans that Windows DOESN'T have a flaw that IS present on OS X, Linux and any other Unix-based OS.
52 months ago
- iCloud hacks
Last month.
- iOS 8 issues
- iOS 8.0.1 issues
Ok.
- Bentgate
Physics.
- HealthKit issues
Part of 'iOS 8 issues'.
- iPhone 6 RAM issues
Not an issue at all, just some idiots who think RAM is free.
- Free U2 Album issues
Weeks ago.
- Restricted NFC chip
Not an issue, just a business decision that not everyone agrees with.
- Keynote streaming issues
Weeks ago. (Though otherwise valid.)
So yeah, not too bad at all.
52 months ago
Relax, people, the sky is not falling.
This problem primarily affects things running a (web) server.
Your home Mac might technically be affected, but you're likely not running anything that exposes the bug to an attacker.
This problem primarily affects things running a (web) server.
Your home Mac might technically be affected, but you're likely not running anything that exposes the bug to an attacker.
52 months ago
strike three. you're out...
now what?
*still waiting for iPhone + Apple Watch*
now what?
*still waiting for iPhone + Apple Watch*
52 months ago
Last month.
Ok.
Physics.
Part of 'iOS 8 issues'.
Not an issue at all, just some idiots who think RAM is free.
Weeks ago.
Not an issue, just a business decision that not everyone agrees with.
Weeks ago. (Though otherwise valid.)
So yeah, not too bad at all.
Apple apologist alert!
52 months ago
So is this only a problem if SSH sharing is enabled?
This is only a problem if you have something like a server that runs bash scripts that set environment variables to values that come from untrusted sources (e.g. html forms, API calls).
If you are not sure if you are running such a thing you are most likely not directly affected by this.
[ Read All Comments ]
One year after launching the successful live game show app HQ Trivia, Intermedia Labs is planning a new game called HQ Words. Instead of a basic series of trivia questions and multiple choice...
MacRumors has received confirmation that the names of Apple's latest iPhone models are to be stylized with a capital X, followed by the S or R in Small Caps, which are lowercase characters...
Now that we're just three days away from the launch of the iPhone XS and iPhone XS Max, Apple has given the green light for publications and YouTubers to publish full reviews and unboxing videos...
Twitter recently confirmed that it is bringing back the classic reverse chronological timeline as an option for its users.
In a series of Tweets sent by @TwitterSupport, the company explained...
Withings has returned with a new hybrid smartwatch offering, after one of the company's co-founders bought the brand back from Nokia earlier this year.
Back in 2016, Nokia acquired health...
Apple today published an updated version of its iOS security white paper [PDF] for iOS 12, with information on new features and updates introduced with the iOS 12 software.
According to...
Instagram today announced two major updates to the shopping feature in the Instagram app that's designed to allow users to make purchases directly from Instagram.
Shopping within Stories, a...
Apple today updated its suite of iWork apps for iOS devices, introducing iOS 12 support for Pages, Numbers, and Keynote. All three of the apps now support Siri Shortcuts, a feature designed to let...
