Several days ago a group of researchers claimed to have found a bug in the variable declaration Bash allowing execute code (even remotely) on Unix and Linux operating systems. Although this vulnerability (known as Shellshock) has already been solved there are still quite vulnerable servers and being exploited by hackers.
Shellshock took a few hours to have a patch that solved the vulnerability, however, the task of installing the patch has fallen directly on system administrators or users who must be manually apply and check that Bash has been updated to latest non-vulnerable version.
Curiosity has made various security researchers began testing a series of similar attacks in the Command Prompt window of Windows operating systems and after several investigations, some developers have claimed to have found a way to exploit a vulnerability similar . For Windows operating systems, hackers can exploit the environment variables similar to the exploits designed to exploit vulnerabilities in Bash.
The vulnerability may allow a normal user of a network to take full control of a server connected to the same network by simply creating a folder and running a series of configured to exploit the flaw in reading and execution environment variables scripts.
This similar to Shellshock vulnerability is present in all versions of Microsoft operating systems, including the new Windows 10. Although the ruling is quite dangerous to within a local network, it is unlikely that hackers can exploit remotely.
Microsoft claims that this "failure" is not a vulnerability itself but the responsibility for this lies with the network administrator because it is a misuse of language programming. Therefore, at present, has no plans to develop and release a patch that fixes the vulnerability and asks managers to avoid exploiting this vulnerability should review the scripts best. What do you think of this failure CMD? Do you think Microsoft has finally also succumbed to Shellshock?
More From Author
Security
