In the OS X Terminal you run commands in an interpreter called a shell. In general, you open a shell and then specify commands to execute within it; however, researchers have found a long-standing vulnerability in the popular shell called “bash” (the default for user accounts in OS X), where with a clever use of environmental variables for running the bash shell, an attacker can inject code to run in the shell without needing to directly enter it in the shell itself.

This might seem like a problem only for those who use the Terminal, and while for the most part OS X programs and services do not use the Terminal, there are some instances where this vulnerability could potentially be a problem, especially for system configuration and sharing services.

This vulnerability, dubbed “shell shock,” can be seen in OS X and other systems with a Unix terminal, by simply running the following command, which sets up an environmental variable “x” for the shell “bash” that is specified at the end of the command. In this case, the “x” value contains a function, followed by the “echo” command. The “echo” command should technically not execute; however, if you run it on a system that is vulnerable, then it will do so.

env x='() { :ignored function;}; echo this should not show' bash

While this might seem like a mundane issue to those not familiar with the problem, there are a number of applications and services (especially those with client/server interactions, where the bash shell is used to quickly change configurations or pass files and data back and forth between programs.

Generally, these interactions are done in a protected way which limits the scope of what can be accomplished by invoking Bash, but this vulnerability allows for the execution of arbitrary code at the same permissions level as the program receiving the command. This means if you have a service running as root (such as a DHCP configuration routine) that uses this approach for configuration changes, then a malicious DHCP server could technically send commands that could run with full administration privileges on your system.

Keep in mind that this problem not only affects OS X, but also Linux, Unix, and other operating systems, as well as many hardware devices like routers that use the bash shell to run test routines like traceroute and ping.

If you are concerned about this problem, then for the most part it is still in discovery mode and no known and effective exploits are out for it. You are likely OK if you connect to trusted networks and Web sites, and otherwise adhere to safe computing practices; however, this problem being so widespread means there is ample opportunity for hackers to take advantage of it.

As a result of this, your best bet for now is to simply keep your system and any devices you use fully updated. With the bug being known, and with patches being worked on as you read this, so expect there to be software and firmware updates for OS X, third-party software, as well as routers, printers, and other hardware devices you use.

UPDATE: There is an unofficial fix available from Gnu.org, that can be used to patch the versions of Bash that are included with OS X. See here for details.