Where is Bash Shellshock vulnerability in source code? - Information Security Stack Exchange

Where is Bash Shellshock vulnerability in source code? - Information Security Stack Exchange

CVE-2014-6271

CVE-2014-6271 was the first vulnerability discovered. A patch can be found here.

From Wikipedia:

Function definitions are exported by encoding them within the environment variable list as variables whose values begin with parentheses ("()") followed by a function definition. The new instance of Bash, upon starting, scans its environment variable list for values in this format and converts them back into internal functions.

Bash performs this conversion by creating a fragment of code that defines the function and executing it, but it does not verify that the fragment is merely a function definition. Therefore anyone who can cause Bash to execute with a particular name/value pair in its environment, can also execute arbitrary commands by appending those commands to an exported function definition.

Read full article from Where is Bash Shellshock vulnerability in source code? - Information Security Stack Exchange