1. Shellshock was discovered by Stéphane Chazelas, who reported it to bash maintainer Chet Ramey and a few others, and assigned CVE identifier CVE-2014-6271.
2. "CVE-2014-6271: remote code execution through bash" by Florian Weimer of Red Hat (2014-09-24) was one of the first public disclosures of the problem.
3. Florian Weimer (Debian contributor and Red Hat employee) posts a patch for bash that counters the attack.
4. Red Hat, CentOS, Fedora, Oracle Linux, Debian, and Ubuntu adopt Weimer’s patch. Apple’s later OS X bash update 1.0 includes it as well.
5. Chet Ramey posts bash43-027 at 2014-09-27 22:50:07, accepting Weimer's patch into the upstream mainline.
Remember, it's always good to cite your sources (if you have any).
And now, it's been fun but good night!
"Most source packages in all Ubuntu components are copied unmodified from Debian."
Oh NOES right on the Debian wiki it says that Unstable might have horrible bugs! And if you run it on a server you are insane!
And... it says Debian's security team only covers Stable. Maybe this is why the Ubuntu forums got hacked and every user account, password and email address was stolen?
Canonical are the people whose forums were hacked, user information stolen, and remained down for two weeks while they attempted to restore backups and patch the exploit. They release by far the buggiest linux distribution in history, in fact it is based on Debian Unstable.
Ubuntu 14.04 LTS includes the 3.13 version of the Linux kernel. This is not an upstream long term supported kernel. This means that the Ubuntu maintainers will have to do all the backporting work without any help from the community, for five years, to a kernel that no other distribution will use.
Add the increasing numbers of open source developers infuriated by Canonical's misdeeds with Mir, Unity, and Upstart, and it is clear that Ubuntu is the distro with the challenge to remain relevant.
DS: That's not going to help sell more Zunes, Steve.
SB: Uh, yeah well it's time for new challenges, if you know what I mean. But between steering Microsoft
into an iceberg and my well known temper tantrums, I'm afraid the NBA won't let me buy a team.
DS: I'll put in a good word for you.
SB: That's not going to cut it, Don. What I need is for you to create a distraction. A train wreck caliber
disturbance so profound the NBA will be glad to have me.
DS: Oh my God.