[Pete Svarrior]

Also, I just noticed this wonderful piece of FUD in Arse Technica's article:

As a result, the attacker can run programs with the same level of access as the part of the system launching a bash shell. And in the case of a web server, that's practically the same level of access as an administrator, giving the attacker a way to gain full control of the targeted system.

No. It doesn't. If you run your web server as root, you have much more serious problems to deal with than "shellshock". I find it funny that Parsifal had already mentioned this before we saw the article:

Best case scenario, they get in via a web server (you don't run your web server as root, right?)

[xasop]

We've discovered a new category of potential bugs in shells. Yes, you're gonna see a couple of them. If you're going to think they're one and the same bug, chances are you have more serious security problems than bash.

Arguably, the bug is that function imports are a thing. The idea that you can have code automagically imported from data, especially data as unpredictable as the environment, is just wrong, and I'm not aware of anybody ever actually making use of it. The correct fix would be to remove that functionality entirely; yes, it's an API change, but it's such a broken API that this is one of the very rare cases where that would be appropriate.

[Pete Svarrior]

Arguably, the bug is that function imports are a thing. The idea that you can have code automagically imported from data, especially data as unpredictable as the environment, is just wrong, and I'm not aware of anybody ever actually making use of it. The correct fix would be to remove that functionality entirely; yes, it's an API change, but it's such a broken API that this is one of the very rare cases where that would be appropriate.

See, I'm in two minds about that. I'm also unaware of anyone actually using this functionality, but I'm always wary of removing something that's already there. Because of that, I wouldn't necessarily call it "the correct fix", but rather "a very reasonable trade-off".