The Shellshock vulnerability that was recently discovered in a commonly used piece of software dating back at least 20 years, apparently does not affect most users of Apple Mac computers, as earlier suggested. Although the Bash command shell is included in OS X, it is not vulnerable unless users specifically enable it. Since very few users are even aware of its presence, they will not have to take any corrective measures.
Apple enthusiast site
iMore has quoted a company spokesperson as saying "Bash, a UNIX command shell and language included in OS X, has a weakness that could allow unauthorized users to remotely gain control of vulnerable systems. With OS X, systems are safe by default and not exposed to remote exploits of bash unless users configure advanced UNIX services. We are working to quickly provide a software update for our advanced UNIX users."
Users who are very familiar with Bash can patch the problem themselves, or at least disable the services until Apple releases an official fix. It was feared that users of Apple devices would be particularly at risk because OS X and iOS are both based on derivatives of UNIX, one of the oldest operating systems still widely in use.
Linux and Android have also descended from Unix, as are dozens of custom operating systems designed for appliances, embedded equipment and industrial machinery. Internet servers commonly run on Unix or Unix-based operating systems, and Bash is widely used as a remote administrative tool. These systems will also be
vulnerable to Shellshock attacks unless insulated from contact via the Internet.
The
Shellshock vulnerability, also called Bash Bug, could allow attackers to execute commands on computers and similar devices via the Internet. With the right tools and access, it would be possible for attackers to steal data such as passwords, and cause
other kinds of mischief.