Shellshock linux vulnerability

x00

Please read

http://www.theregister.co.uk/2014/09/24/bash_shell_vuln/

x00

This is not meant as a definitive test

You can check if you're vulnerable by running the following lines in your default shell, which on many systems will be Bash. If you see the words "busted", then you're at risk. If not, then either your Bash is fixed or your shell is using another interpreter.

>

env X="() { :;} ; echo busted" /bin/sh -c "echo completed"
env X="() { :;} ; echo busted" `which bash` -c "echo completed"

x00

keep applying updates when they come, becuase patches are mostly incomplete and not the full solution.

x00

it is also good idea to individually update bash, rather then relying on distro updates.

peregrine

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2014-7169

https://www.us-cert.gov/ncas/alerts/TA14-268A

http://arstechnica.com/security/2014/09/bug-in-bash-shell-creates-big-security-hole-on-anything-with-nix-in-it/

hgtonight

Thanks for the notice, my bash was susceptible to this bug.

VanillaFan

New Exploit Method

bash -c 'true <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF' || echo "CVE-2014-7186 vulnerable, redir_stack"

(for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash || echo "CVE-2014-7187 vulnerable, word_lineno"

Very helpful site for checking new shellshock exploit and updates
https://shellshocker.net