Linked Questions

-1
votes
1answer
141 views

how to patch bash vulnerability (shellshock) bug on RHEL? [duplicate]

We have over 10000 servers to patch for bash vulnerability (shellshock) bug. Now my question is what is the command to patch this bug ? And how we can check whether the patch has been installed and ...
0
votes
0answers
24 views

Are there any more developments regarding ShellShock? [duplicate]

I updated bash on September 26th to protect against the ShellShock vulnerability. I have heard a rumour that further vulnerabilities have been reported, but another yum -y update bash just now (1600 ...
234
votes
5answers
107k views

What does env x='() { :;}; command' bash do and why is it insecure?

There is apparently a vulnerability (CVE-2014-6271) in bash: Bash specially crafted environment variables code injection attack I am trying to figure out what is happening, but I'm not entirely sure ...
20
votes
7answers
4k views

Is the “callback” concept of programming existent in Bash?

A few times when I read about programming I came across the "callback" concept. Funnily, I never found an explanation I can call "didactic" or "clear" for this term "callback function" (almost any ...
27
votes
4answers
18k views

bash iterate file list, except when empty

I thought this would be simple - but it is proving more complex than I expected. I want to iterate through all the files of a particular type in a directory, so I write this: #!/bin/bash for fname ...
19
votes
3answers
2k views

How do I explicitly and safely force the use of a built-in command in bash

There's a similar question that deals with the 'wrapping' scenario, where you want to replace for example cd with a command that calls the builtin cd. However, in light of shellshock et al and ...
19
votes
1answer
671 views

How was the Shellshock Bash vulnerability found?

Since this bug affects so many platforms, we might learn something from the process by which this vulnerability was found: was it an εὕρηκα (eureka) moment or the result of a security check? Since we ...
7
votes
2answers
3k views

Bash - Functions in Shell Variables

I am reading this post on using functions in bash shell variables. I observe that to use shell functions, one has to export them and execute them in a child shell as follows: $ export foo='() { echo "...
3
votes
3answers
21k views

How to track/log commands executed on a shell?

Can commands be written to a logfile before they were executed in any shells? I know there is a patch for ssh to log all commands from ssh sessions, but i want to log even commands executed from a ...
5
votes
2answers
2k views

Can you execute a Bash function with the `at` command?

I want to execute a Bash function at a scheduled time. I think the right tool for this is the at command. However, it doesn't seem to be working. function stupid () { date } export -f stupid ...
6
votes
1answer
662 views

What do the commas in “${var,,}” mean?

read -p "Enter yes/no " SOMEVAR SOMEVAR=`"echo ${SOMEVAR,,}"` The code above gives me a ${SOMEVAR,,}: bad substitution error.
4
votes
3answers
5k views

CVE-2014-6271 Bash Vulnerability example [duplicate]

I am trying to understand what could be the security concern of CVE-2014-6271 and all the links I see just gives me the below command. env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ...
1
vote
1answer
4k views

Which Debian patches fixes shellshock lcamtuf CVE-2014-6277 and CVE-2014-6278? [closed]

Note that this question is definitely not a duplicate of: When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it? According to: https://security-...
1
vote
1answer
2k views

Shellshock - not vulnerable with bash version 4.1?

We have several Amazon servers. It has bash version 4.1.2. Kaspersky claims that all bash versions up to 4.3 are unsafe. When I do this test... env x='() { :;}; echo vulnerable' bash -c 'echo hello' ...
0
votes
1answer
304 views

Bash shell functions and understanding shell shock

I asked a related question on defining and using shell functions in bash. In this question I want to ask specifically which way of defining function can lead to shellshock. I did some tests and I want ...