Understanding OPENVAS Wireshark Capture

Question

I was looking at a sample capture from a tutorial I was looking at and below is a snippet of a wireshark packet capture:

OpenVAS:() { _; OpenVAS; } >_[$($())] {  echo Content-Type: text/plain; echo; echo; PATH=/usr/bin:/usr/local/bin:/bin; export PATH; id; }

My understanding of the above is that the malicious individual is using OpenVAS to scan for vulnerabilities. Using openvas, he then defines what paths he wants to export using PATH=/usr/bin:/usr/local/bin:/bin. He then exports using export PATH. Not sure what 'id' is.

Can someone assist in clarifying what exactly is going on? I think I'm on the right path but need help.

Answer 1

OpenVAS is not being used; that name is arbitrary, and perhaps a red herring, or a nose-tweak of people analyzing it (such as yourself).

This is an example of the shellshock bug which was very big news four years ago. Use the search box to find dozens of Qs about it here on security.SX and nearly as many on unix.SX and serverfault. This example is clearly aimed at a CGI server, and causes it (if vulnerable) to output a simple HTTP response containing the output of the id command, which is harmless in itself but demonstrates unauthorized execution on the target which could have been used to do much worse things.