Shellshock bug, Bash vulnerability might be worse than Heartbleed, OS X users safe Apple says

(CREDIT: REUTERS/MAL LANGSDON)A lock icon, signifying an encrypted Internet connection, is seen on an Internet Explorer browser in a photo illustration in Paris April 15, 2014.

The bourne-again Shellshock bug or Bash vulnerability discovered on Wednesday, can be worse than Heartbleed, according to experts.

"People were taking Heartbleed very seriously," said Jim Reavis, CEO of cybersecurity firm Cloud Security Alliance.

Reavis added, "If people don't take Bash seriously, it'll become a self-fulfilling prophecy."

While tech authorities are already racing to create fixes, cybercriminals are already working their way to take advantage of the vulnerable systems.

"Just about every network device (routers, switches, SDN) runs on a flavor of Unix and bash is widely deployed. Systems that are vulnerable will be those that allow components to run shell scripts, a very common shortcut," Richard Stiennon of Forbes reported.

He continued, "While the use of Shellshock for highly targeted attacks on systems that you probably don't even know about within your network is the biggest long-term concern, the short term possibilities are frightening. The code linked to above could quickly create a SQL Slammer type Internet meltdown."

Robert Graham of Errata Security encouraged some sense of urgency to fix the bug.

"Scan your network for things like Telnet, FTP, and old versions of Apache (masscan is extremely useful for this). Anything that responds is probably an old device needing a bash patch. And, since most of them can't be patched, you are likely screwed," he said.

The vulnerability, codenamed CVE-2014-6271 in the US National Cyber Awareness System, affects Apple's Mac OS X among others and patches have been made available.

Apple, Inc., has also clarified that, in principle, most Mac and iOS users are safe from the security flaw.

"The vast majority of OS X users are not at risk to recently reported bash vulnerabilities," an Apple spokesman said.

The spokesman added, "Bash, a Unix command shell and language included in OS X, has a weakness that could allow unauthorized users to remotely gain control of vulnerable systems. With OS X, systems are safe by default and not exposed to remote exploits of bash unless users configure advanced Unix services. We are working to quickly provide a software update for our advanced Unix users."

Wall Street Journal has also warned that if a user is familiar with "advanced Unix services" and has engaged with it in any way, should contact Apple support right away.

Copyright © 2014 Ecumenical News