Newsroom

The Federal Financial Institutions Examination Council on Friday released a statement urging credit unions and banks to quickly address the "Shellshock" vulnerability by applying patches to their Bash software.

FFIEC said Bash, or Bourne-again Shell – a common software tool found in most UNIX, Linux, and Mac OS X operating systems and which also may be installed on Windows servers – is used to execute a sequence of commands. It said the Shellshock vulnerability could allow an attacker to execute malicious code on Bash and gain control over a targeted system.

"The pervasive use of Bash and the potential for this vulnerability to be automated presents a material risk," the council said in its statement, which also provided a two-page alert outlining steps to be taken.

The FFIEC recommended that financial institutions and their service providers assess the risk to their infrastructures and execute mitigation activities with appropriate urgency.

"Financial institutions should identify all servers, systems, and appliances that use the vulnerable versions of Bash and follow appropriate patch management practices," which are detailed in FFIEC's Information Technology Handbooks, including handbooks addressing development and acquisition, information security and operations.