Shellshock (software bug) (English Wikipedia)

Strohm, Chris; Robertson, Jordan (30 September 2014). "Shellshock Draws Hacker Attacks, Sparks Race to Patch Bug". Businessweek. Archived from the original on 1 October 2014. Retrieved 1 October 2014.

arstechnica.com

Gallagher, Sean (26 September 2014). "Still more vulnerabilities in bash? Shellshock becomes whack-a-mole". Arstechnica. Retrieved 26 September 2014.
Gallagher, Sean (26 September 2014). "New "Shellshock" patch rushed out to resolve gaps in first fix [Updated]". Retrieved 2 November 2014.

bbc.com

Various (26 September 2014). "Web attacks build on Shellshock bug". BBC. Retrieved 26 September 2014.

businessweek.com

Strohm, Chris; Robertson, Jordan (30 September 2014). "Shellshock Draws Hacker Attacks, Sparks Race to Patch Bug". Businessweek. Archived from the original on 1 October 2014. Retrieved 1 October 2014.

carbon60.com

lists.archive.carbon60.com

Kyle George (27 September 2014). "qmail is a vector for CVE-2014-6271 (bash shellshock)". qmail (Mailing list).

dwheeler.com

"Shellshock". 13 February 2015. Retrieved 17 September 2016.

fedoraproject.org

lists.fedoraproject.org

"[SECURITY] Fedora 21 Update: bash-4.3.25-2.fc21". FedoraProject.org. 27 September 2014. Retrieved 2 November 2014.

futuresouth.us

"Yahoo! Shellshocked Like Ninja Turtles!". Archived from the original on 9 October 2014. Retrieved 7 October 2014.

gmane.org

thread.gmane.org

Chazelas, Stéphane (10 October 2014). "when was shellshock introduced". Stéphane Chazelas and Chet Ramey confirm the vulnerability introduction date on Bash official communication channel. Archived from the original on 20 December 2016. Retrieved 14 October 2014.

gnu.org

ftp.gnu.org

"BASH PATCH REPORT". GNU.org. 12 September 2014. Retrieved 2 November 2014.
"BASH PATCH REPORT". GNU.org. 25 September 2014. Retrieved 2 November 2014.
"BASH PATCH REPORT". GNU.org. 25 September 2014. Retrieved 2 November 2014.

gnu.org

"Bash Reference Manual: Shell Functions". Retrieved 2 October 2014.

git.savannah.gnu.org

"Bash 4.3 source code, file variables.c, lines 315-388". Retrieved 2 October 2014.

lists.gnu.org

Ramey, Chet. "Re: CVE-2014-7187". lists.gnu.org.

golem.de

Hanno Böck (7 October 2014). "Yahoo durch Shellshock angegriffen". Golem - IT-News für Profis (in German). Retrieved 30 October 2014.

heise.de

Staff (28 September 2014). "Shellshock, Part 3: Three more security problems in Bash (in german)". Heise Online. Retrieved 28 September 2014.

ibm.com

"IBM HMC is a vector for CVE-2014-6271 (bash "shellshock")". IBM. Archived from the original on 19 January 2020.

www-304.ibm.com

"Security Bulletin: Vulnerabilities in Bash affect DS8000 HMC (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)". IBM. 3 October 2014. Retrieved 2 November 2014.

independent.co.uk

Boren, Zachary (6 October 2014). "Shellshock: Romanian hackers are accessing Yahoo servers, claims security expert". Independent. Retrieved 7 October 2014.

itnews.com.au

Saarinen, Juha (29 September 2014). "Further flaws render Shellshock patch ineffective". iTnews. Retrieved 29 September 2014.
Saarinen, Juha (26 September 2014). "First Shellshock botnet attacks Akamai, US DoD networks". iTnews. Retrieved 26 September 2014.

lcamtuf.blogspot.com

"Bash bug: the other two RCEs, or how we chipped away at the original fix (CVE-2014-6277 and '78)". lcamtuf blog. 1 October 2014. Retrieved 8 October 2014.

macrumors.com

Clover, Juli (29 September 2014). "Apple Releases OS X Bash Update to Fix 'Shellshock' Security Flaw in Mavericks, Mountain Lion, and Lion". MacRumors.com. Retrieved 2 October 2014.
Slivka, Eric (30 September 2014). "Apple Releases OS X Yosemite Golden Master Candidate to Developers [Update: Also Public Beta]". MacRumors.com. Retrieved 2 October 2014.

nist.gov

web.nvd.nist.gov

"Vulnerability Summary for CVE-2014-6271". NIST. 4 October 2014. Retrieved 8 October 2014.
Staff (27 September 2014). "National Cyber Awareness System Vulnerability Summary for CVE-2014-6277". National Institute of Standards and Technology. Retrieved 28 September 2014.
Staff (30 September 2014). "National Cyber Awareness System Vulnerability Summary for CVE-2014-6278". National Institute of Standards and Technology. Retrieved 1 October 2014.
Staff (29 September 2014). "National Cyber Awareness System Vulnerability Summary for CVE-2014-7186". National Institute of Standards and Technology. Retrieved 1 October 2014.
Staff (29 September 2014). "National Cyber Awareness System Vulnerability Summary for CVE-2014-7187". National Institute of Standards and Technology. Retrieved 1 October 2014.

nytimes.com

Perlroth, Nicole (25 September 2014). "Security Experts Expect 'Shellshock' Software Bug in Bash to Be Significant". New York Times. Retrieved 25 September 2014.

bits.blogs.nytimes.com

Perlroth, Nicole (26 September 2014). "Companies Rush to Fix Shellshock Software Bug as Hackers Launch Thousands of Attacks". New York Times. Retrieved 29 September 2014.

oldlinux.org

Fox, Brian (21 March 1990). "Bash 1.05 ChangeLog". Archived from the original on 6 December 2023. Retrieved 14 October 2014.

opensuse.org

lists.opensuse.org

"SUSE Security Update: Security update for bash". OpenSUSE. 28 September 2014. Retrieved 2 November 2014.

openwall.com

Weimer, Florian (25 September 2014). "Re: CVE-2014-6271: remote code execution through bash". Openwall Project. Retrieved 2 November 2014.

pcworld.com

Constatin, Lucian (29 September 2014). "Improved patch tackles new Shellshock Bash bug attack vectors". PC World. Retrieved 1 October 2014.

qualys.com

blog.qualys.com

Wolfgang Kandek (24 September 2014). "The Laws of Vulnerabilities". Qualys.com. Archived from the original on 3 May 2016. Retrieved 26 September 2014.

redhat.com

securityblog.redhat.com

"Bash specially-crafted environment variables code injection attack". Red Hat Security. Retrieved 2 October 2014.

rhn.redhat.com

"Important: bash security update". Red Hat. 30 September 2014. Retrieved 2 November 2014.

access.redhat.com

"Bash Code Injection Vulnerability via Specially Crafted Environment Variables (CVE-2014-6271, CVE-2014-7169)". Red Hat. 2 October 2014. Retrieved 2 November 2014.

seclists.org

Florian Weimer (24 September 2014). "Re: CVE-2014-6271: remote code execution through bash". oss-sec (Mailing list). Retrieved 1 November 2014.
Florian Weimer (24 September 2014). "Re: CVE-2014-6271: remote code execution through bash". oss-sec (Mailing list). Retrieved 1 November 2014.

stackexchange.com

unix.stackexchange.com

Chazelas, Stéphane (25 September 2014). "When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?".

technologyreview.com

Cerrudo, Cesar (30 September 2014). "Why the Shellshock Bug Is Worse than Heartbleed". MIT Technology Review. Retrieved 1 October 2014.

theregister.co.uk

Leyden, John (24 September 2014). "Patch Bash NOW: 'Shell Shock' bug blasts OS X, Linux systems wide open". The Register. Retrieved 25 September 2014.

thesafemac.com

Although described in some sources as a "virus," Shellshock is instead a design flaw in a program that comes with some operating systems. See => Staff (25 September 2014). "What does the "Shellshock" bug affect?". The Safe Mac. Archived from the original on 29 September 2014. Retrieved 27 September 2014.

ubuntu.com

"USN-2364-1: Bash vulnerabilities". Canonical Ltd. 27 September 2014. Retrieved 2 November 2014.

web.archive.org

Although described in some sources as a "virus," Shellshock is instead a design flaw in a program that comes with some operating systems. See => Staff (25 September 2014). "What does the "Shellshock" bug affect?". The Safe Mac. Archived from the original on 29 September 2014. Retrieved 27 September 2014.
Fox, Brian (21 March 1990). "Bash 1.05 ChangeLog". Archived from the original on 6 December 2023. Retrieved 14 October 2014.
Chazelas, Stéphane (10 October 2014). "when was shellshock introduced". Stéphane Chazelas and Chet Ramey confirm the vulnerability introduction date on Bash official communication channel. Archived from the original on 20 December 2016. Retrieved 14 October 2014.
"Yahoo! Shellshocked Like Ninja Turtles!". Archived from the original on 9 October 2014. Retrieved 7 October 2014.
Wolfgang Kandek (24 September 2014). "The Laws of Vulnerabilities". Qualys.com. Archived from the original on 3 May 2016. Retrieved 26 September 2014.
"IBM HMC is a vector for CVE-2014-6271 (bash "shellshock")". IBM. Archived from the original on 19 January 2020.

wired.com

Greenberg, Andy (25 September 2014). "Hackers Are Already Using the Shellshock Bug to Launch Botnet Attacks". Wired. Retrieved 28 September 2014.

zdnet.com

Seltzer, Larry (29 September 2014). "Shellshock makes Heartbleed look insignificant". ZDNet. Retrieved 29 September 2014.
Vaughan-Nichols, Steven (27 September 2014). "Shellshock: Better 'bash' patches now available". ZDNet. Retrieved 29 September 2014.