Linked Questions

-1
votes
1answer
170 views

how to patch bash vulnerability (shellshock) bug on RHEL? [duplicate]

We have over 10000 servers to patch for bash vulnerability (shellshock) bug. Now my question is what is the command to patch this bug ? And how we can check whether the patch has been installed and ...
245
votes
5answers
113k views

What does env x='() { :;}; command' bash do and why is it insecure?

There is apparently a vulnerability (CVE-2014-6271) in bash: Bash specially crafted environment variables code injection attack I am trying to figure out what is happening, but I'm not entirely sure ...
21
votes
7answers
8k views

Is the “callback” concept of programming existent in Bash?

A few times when I read about programming I came across the "callback" concept. Funnily, I never found an explanation I can call "didactic" or "clear" for this term "callback function" (almost any ...
54
votes
4answers
33k views

bash iterate file list, except when empty

I thought this would be simple - but it is proving more complex than I expected. I want to iterate through all the files of a particular type in a directory, so I write this: #!/bin/bash for fname ...
20
votes
3answers
3k views

How do I explicitly and safely force the use of a built-in command in bash

There's a similar question that deals with the 'wrapping' scenario, where you want to replace for example cd with a command that calls the builtin cd. However, in light of shellshock et al and ...
20
votes
1answer
848 views

How was the Shellshock Bash vulnerability found?

Since this bug affects so many platforms, we might learn something from the process by which this vulnerability was found: was it an εὕρηκα (eureka) moment or the result of a security check? Since we ...
7
votes
2answers
5k views

Bash - Functions in Shell Variables

I am reading this post on using functions in bash shell variables. I observe that to use shell functions, one has to export them and execute them in a child shell as follows: $ export foo='() { echo "...
11
votes
1answer
2k views

What do the commas in “${var,,}” mean?

read -p "Enter yes/no " SOMEVAR SOMEVAR=`"echo ${SOMEVAR,,}"` The code above gives me a ${SOMEVAR,,}: bad substitution error.
4
votes
3answers
29k views

How to track/log commands executed on a shell?

Can commands be written to a logfile before they were executed in any shells? I know there is a patch for ssh to log all commands from ssh sessions, but i want to log even commands executed from a ...
5
votes
2answers
3k views

Can you execute a Bash function with the `at` command?

I want to execute a Bash function at a scheduled time. I think the right tool for this is the at command. However, it doesn't seem to be working. function stupid () { date } export -f stupid ...
4
votes
3answers
5k views

CVE-2014-6271 Bash Vulnerability example [duplicate]

I am trying to understand what could be the security concern of CVE-2014-6271 and all the links I see just gives me the below command. env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ...
1
vote
1answer
4k views

Which Debian patches fixes shellshock lcamtuf CVE-2014-6277 and CVE-2014-6278? [closed]

Note that this question is definitely not a duplicate of: When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it? According to: https://security-...
1
vote
1answer
2k views

Shellshock - not vulnerable with bash version 4.1?

We have several Amazon servers. It has bash version 4.1.2. Kaspersky claims that all bash versions up to 4.3 are unsafe. When I do this test... env x='() { :;}; echo vulnerable' bash -c 'echo hello' ...
0
votes
1answer
467 views

Bash shell functions and understanding shell shock

I asked a related question on defining and using shell functions in bash. In this question I want to ask specifically which way of defining function can lead to shellshock. I did some tests and I want ...
2
votes
1answer
226 views

bash: exported function not visible, but variables are

Over the years I've collected sort of a library of bash functions the shell and scripts refer to. To decrease the import boilerplate, I'm exploring options how to reasonably include the library in ...