{"product_id":"shellshock-shirt-cve-2014-6271-bash-bug-graphic-tee-unhacked","title":"EXHIBIT 0018 — SHELLSHOCK","description":"\u003cp\u003eIt is remembered as a web server bug. It was in bash, and it had been sitting there since 1989.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eBash can hand a shell function to a child process. It does that by writing the function body into an environment variable, and the child, on startup, parses that variable back into a function again.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eThe parser did not stop at the closing brace. Anything after it was executed on the spot, as a command, before the shell had run a single line of whatever it had actually been invoked to do.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eThe whole exploit was the string () { :; }; followed by whatever you wanted.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eThe delivery mechanism was CGI. A web server running a CGI script copies HTTP request headers into environment variables, so a User-Agent header carrying that function definition ran commands on the server as whatever user the web server happened to be.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eStéphane Chazelas found it and reported it privately to Chet Ramey, the bash maintainer, on 12 September 2014. It went public on 24 September with a CVSS score of 10.0.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eThe code responsible was introduced in bash 1.03, in September 1989. Twenty-five years, in a program that runs on essentially every Unix system ever shipped.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eThe first patch was incomplete. Tavis Ormandy had a working bypass inside a day, which became CVE-2014-7169, and four further CVEs followed that same week.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eBash has been maintained for over thirty years, largely by one person, and read carefully by almost nobody.\u003c\/p\u003e\u003cp\u003e\u003c\/p\u003e\u003cp\u003eEXHIBIT 0018 \/ SHELLSHOCK \/ 2014\u003c\/p\u003e","brand":"Printify","offers":[{"title":"Light Blue \/ S","offer_id":54505873768732,"sku":"65484793059647257433","price":24.99,"currency_code":"USD","in_stock":true},{"title":"White \/ S","offer_id":54505873801500,"sku":"17390213721659084474","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Heather Royal \/ S","offer_id":54505873834268,"sku":"42063188067345798671","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Natural \/ S","offer_id":54505873867036,"sku":"17997719842964953032","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Ice Grey \/ S","offer_id":54505873899804,"sku":"30121165815608951412","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Sand \/ S","offer_id":54505873932572,"sku":"15744936837273264222","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Light Blue \/ M","offer_id":54505873965340,"sku":"33909478472376708963","price":24.99,"currency_code":"USD","in_stock":true},{"title":"White \/ M","offer_id":54505873998108,"sku":"32757588928718719151","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Heather Royal \/ M","offer_id":54505874030876,"sku":"18676127911547218127","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Natural \/ M","offer_id":54505874063644,"sku":"10303913187951965665","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Ice Grey \/ M","offer_id":54505874096412,"sku":"19261795612362610685","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Sand \/ M","offer_id":54505874129180,"sku":"13676973394150326205","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Light Blue \/ L","offer_id":54505874161948,"sku":"44267445676135081266","price":24.99,"currency_code":"USD","in_stock":true},{"title":"White \/ L","offer_id":54505874194716,"sku":"23054362629890832898","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Heather Royal \/ L","offer_id":54505874227484,"sku":"16995092630542662571","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Natural \/ L","offer_id":54505874260252,"sku":"48840415466048436109","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Ice Grey \/ L","offer_id":54505874293020,"sku":"70323622193132836411","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Sand \/ L","offer_id":54505874325788,"sku":"19682008514688121784","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Light Blue \/ XL","offer_id":54505874358556,"sku":"77991645005469757039","price":24.99,"currency_code":"USD","in_stock":true},{"title":"White \/ XL","offer_id":54505874391324,"sku":"12457592230551502069","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Heather Royal \/ XL","offer_id":54505874424092,"sku":"22790190866991481185","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Natural \/ XL","offer_id":54505874456860,"sku":"53845070218382698643","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Ice Grey \/ XL","offer_id":54505874489628,"sku":"23605077594886936555","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Sand \/ XL","offer_id":54505874522396,"sku":"19104944918021196395","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Light Blue \/ 2XL","offer_id":54505874555164,"sku":"17588419005631557001","price":24.99,"currency_code":"USD","in_stock":true},{"title":"White \/ 2XL","offer_id":54505874587932,"sku":"11498524992725807063","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Heather Royal \/ 2XL","offer_id":54505874620700,"sku":"18348080052751447673","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Natural \/ 2XL","offer_id":54505874653468,"sku":"18014215026150243919","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Ice Grey \/ 2XL","offer_id":54505874686236,"sku":"15923994450351575337","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Sand \/ 2XL","offer_id":54505874719004,"sku":"24629431905716585808","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Light Blue \/ 3XL","offer_id":54505874751772,"sku":"28836048491952733749","price":24.99,"currency_code":"USD","in_stock":true},{"title":"White \/ 3XL","offer_id":54505874784540,"sku":"33011447359644088629","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Heather Royal \/ 3XL","offer_id":54505874817308,"sku":"19298283609910147914","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Natural \/ 3XL","offer_id":54505874850076,"sku":"19106608557090972407","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Ice Grey \/ 3XL","offer_id":54505874882844,"sku":"33264477769983020387","price":24.99,"currency_code":"USD","in_stock":true},{"title":"Sand \/ 3XL","offer_id":54505874915612,"sku":"23200566651170343049","price":24.99,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0961\/8184\/6300\/files\/1061920472558440519_2048.jpg?v=1788378213","url":"https:\/\/unhacked.shop\/products\/shellshock-shirt-cve-2014-6271-bash-bug-graphic-tee-unhacked","provider":"Unhacked","version":"1.0","type":"link"}