-2
votes
1answer
84 views

How can I update BASH [duplicate]

How can I update BASH? I noticed that there are version 4.2.45 env x='() { :;}; echo vulnerable' bash -c "echo this is a test" this is a test cat /etc/redhat-release CentOS release 5.11 (Final) rpm ...
1
vote
1answer
105 views

Shellshock - not vulnerable with bash version 4.1?

We have several Amazon servers. It has bash version 4.1.2. Kaspersky claims that all bash versions up to 4.3 are unsafe. When I do this test... env x='() { :;}; echo vulnerable' bash -c 'echo hello' ...
1
vote
1answer
3k views

Which Debian patches fixes shellshock lcamtuf CVE-2014-6277 and CVE-2014-6278? [closed]

Note that this question is definitely not a duplicate of: When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it? According to: ...
8
votes
2answers
146 views

Why is the ability to definine functions in an enviromental variable not a security risk in itself?

As I understand it, generally it is considered safe to let anyone provide information that will be stored in an environmental variable. The shellshock vulnerability is an issue here because it means ...
1
vote
2answers
191 views

How does the latest “Bash Bug” or exploit affect systems that require authentication?

I'm curious to know how the latest Bash Bug affects systems that require a user login to access the shell. Isn't UNIX/Linux usually configured in a way that you have to be an authenticated user to ...
7
votes
2answers
7k views

How to apply the fix for CVE-2014-6271 bash vulnerability on cygwin?

I would like to find out how do I apply the fix for this vulnerability on cygwin. I am running the CYGWIN_NT-6.1 MYHOSTNAME 1.7.30(0.272/5/3) 2014-05-23 10:36 x86_64 Cygwin of cygwin on Windows 7. ...
7
votes
1answer
5k views

What is the severity of the new bash exploit (shellshock)? [duplicate]

Alternate title: Should I be worried? I've been reading up about the remote bash exploit and was wondering how severe it is and if I should be worried, especially since a new exploit has been found ...
7
votes
4answers
17k views

How to only install security updates on debian

Because of the Shell Shock bug I need to make updates on some of our machines. But I am not sure if all of the packages suggested in apt-get upgrade are OK for my system. In other words I am not sure ...
4
votes
3answers
3k views

CVE-2014-6271 Bash Vulnerability example [duplicate]

I am trying to understand what could be the security concern of CVE-2014-6271 and all the links I see just gives me the below command. env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ...
88
votes
2answers
16k views

When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?

Some context about the bug: CVE-2014-6271 Bash supports exporting not just shell variables, but also shell functions to other bash instances, via the process environment to (indirect) child ...
0
votes
3answers
163 views

How to add a password to a specific command

I've been searching google on how to add additional security to a specific command without using sudo. Is it possible to add on a security feature without actually using sudo? For example: Whenever ...
3
votes
1answer
79 views

Run Script at fail login attempt?

Lately, I've been trying to create a Bash script to capture a webcam photo when a fail attempt to login is registered. First of all, I found 2 guides related to this (links at the end), they explained ...
0
votes
1answer
94 views

Faillog - unsuccessful login count in Motd

I wish to include a count of failed login attempts whenever a user logs in. I've created: /usr/local/bin/dynmotd which contains #!/bin/bash FAILLOG=`faillog -u` echo -e " $FAILLOG " and ...
1
vote
1answer
82 views

Check that only root can edit a script before executing it

I have a script that needs to run as root. It also has a configuration file which is read using source: source conf.sh I would like to check that normal user can't edit conf.sh and therefore get ...
5
votes
1answer
437 views

Save password in bash script for multiple queries

I would like to know if there is a safe way to only be queried for a password once in a custom bash script, and then save it somehow to be used for later needs. At the end of the script it should be ...
1
vote
2answers
622 views

What are ways to encrypt a password inside an environment variable

I have this file I use to set my username and password before exporting the value. #!/bin/bash echo -n "User:"; read user echo -n "Password:"; read -s password export ...
4
votes
1answer
321 views

Can I set a bash timeout only for virtual consoles (ctrl+alt+{f1-f6})

I know that I can set a TMOUT variable to automatically end a bash session after a specified period of inactivity. However, what I want is to apply that only to my 6 built-in virtual consoles, which ...
3
votes
2answers
1k views

How to prevent command injection through command options?

I have an wrapper application where I need to let the user specify custom options to pass to a simulator. However, I want to make sure the user doesn't inject other commands through the user options. ...
26
votes
3answers
2k views

Why shouldn't someone use passwords in the command line?

Why do people fear writing passwords in the command line? The history file is located in ~/.history, so it's available only to the user who executed the commands (and root).
1
vote
1answer
318 views

Securely reading and parsing a string from a parameter or file in bash

I've been writing a number of bash scripts lately which get variables from a parameter or from a file. Some of the scripts run as root (using sudo) This is on my notebook, so there aren't any other ...
7
votes
5answers
1k views

Read and confirm shell script before piping from curl to sh (curl -s [url] | sh)

Whenever I have to execute a shell script from the web curl -s [url] | sh, I first open url in my web browser to make sure the script isn't malicious and is safe to run. I remember seeing a command ...
1
vote
1answer
413 views

How do I hide login information passed to command line programs from appearing in the process list?

I have to execute a program that passes in as command line options the username and password. Is there a way to hide the username & password from appearing in the /proc entry for this process.
6
votes
9answers
11k views

How do I write a test for system login?

I've written a Python CGI script that invokes bash commands, and it needs to test for a successful login on the host. How do I write a test for that? For example, could I create a bash script that ...
12
votes
2answers
2k views

How to safely pass variables to root-enabled scripts?

This question is totally general and not only applicable to my situation, but... I have a small busybox appliance where I want a non-root user to be able to execute a particular script with root ...
36
votes
4answers
4k views

Is there any way to keep a command from being added to your history?

Is there any way to keep a command from being added to your history? I have a command that I want to keep out of my history file, and I really don't care to have it there when I search the history ...
4
votes
3answers
242 views

Randomise or shred memory of an application

Is it possible to randomise or shred memory of a particular application just after its life ends, or better, whenever it deallocates some memory? A command-line utility like this would be perfect: ...