Vulnerability in Bash Shell widespread and serious
Upgrade now, if you can. A bug discovered in the widely used Bash command interpreter poses a critical security risk to Unix and Linux systems - and, thanks to their ubiquity, the internet at large.
From the Register:
From the Register:
It lands countless websites, servers, PCs, OS X Macs, various home routers, and more, in danger of hijacking by hackers.Now is also a good time to wipe your servers and reinstall Minix or Plan9 as a precaution. ;)
The vulnerability is present in Bash up to and including version 4.3, and was discovered by Stephane Chazelas. It puts Apache web servers, in particular, at risk of compromise: CGI scripts that use or invoke Bash in any way - including any child processes spawned by the scripts - are vulnerable to remote-code injection. OpenSSH and some DHCP clients are also affected on machines that use Bash.
Also, according to the bug report, the remaining problems also impact zsh. (edit: this has been refuted since then)
Some more detailed info on the general issue can be found at Red Hat's security blog