Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [shellshock]

Shellshock is a series of security vulnerabilities in bash, starting with (CVE-2014-6271) which allows arbitrary code execution from environment variables.

4
votes
1answer
607 views

Point of the semicolon in this shellshock attack

I was reviewing a shellshock attack and didn't understand this piece of code: curl -v http://localhost/cgi-bin/shellshock.cgi -H "custom:() { ignored; }; echo Content-Type: text/html; echo ; /bin/...
0
votes
1answer
291 views

Inconsistent shellshock exploitation

I am trying to demonstrate the shellshock vulnerability according to the commands posted here. I have taken two systems under consideration: the first one has a vulnerable bash in $PATH; the other ...
0
votes
0answers
3k views

Testing shellshock with CGI [duplicate]

I am trying to test the shellshock bug with CGI. I have a simple CGI script: #!/bin/bash echo "Content-type: text/plain" echo echo echo "Hello World" I trigger the script as follows, and the page ...
1
vote
0answers
275 views

Source code of the patches for Shellshock

I have a project for my grad level OS class, and I have decided to choose the Shellshock vulnerability bugs as my topic. There is a lot of great information out there, but I was curious if it is ...
2
votes
1answer
766 views

Can the shellshock bug be expoloited to run a command as a privileged user?

I am curious to know if the following command could be executed on a system/server with the Shellshock bug: curl -H "User-Agent: () { :; }; sudo /bin/eject" http://example.com/ (This code is an ...
-1
votes
1answer
141 views

how to patch bash vulnerability (shellshock) bug on RHEL? [duplicate]

We have over 10000 servers to patch for bash vulnerability (shellshock) bug. Now my question is what is the command to patch this bug ? And how we can check whether the patch has been installed and ...
0
votes
1answer
338 views

Is my linux mint box vulnerable to Shell-Shock attacks? How might I remedy that? [closed]

Is it safe to use Linux Mint now, with ShellShock existing? If not, what can I do to use Mint safely?
19
votes
1answer
667 views

How was the Shellshock Bash vulnerability found?

Since this bug affects so many platforms, we might learn something from the process by which this vulnerability was found: was it an εὕρηκα (eureka) moment or the result of a security check? Since we ...
0
votes
2answers
205 views

Is one bash shellshock fix tar file for SLES bad?

SERVER:/home/user # rpm -Uvh --test readline-5.1-24.4.7406.0.PTF.898762.i586.rpm warning: readline-5.1-24.4.7406.0.PTF.898762.i586.rpm: V3 DSA signature: NOKEY, key ID b37b98a9 error: Failed ...
1
vote
1answer
2k views

How can I update BASH [duplicate]

How can I update BASH? I noticed that there are version 4.2.45 env x='() { :;}; echo vulnerable' bash -c "echo this is a test" this is a test cat /etc/redhat-release CentOS release 5.11 (Final) rpm ...
1
vote
1answer
2k views

Shellshock - not vulnerable with bash version 4.1?

We have several Amazon servers. It has bash version 4.1.2. Kaspersky claims that all bash versions up to 4.3 are unsafe. When I do this test... env x='() { :;}; echo vulnerable' bash -c 'echo hello' ...
5
votes
2answers
596 views

Did the shellshock bash fix break basic command line tools like echo and cat? [duplicate]

I used to be able to do things like: X=123 cat <<EOF X is $X EOF or even simpler: X=123 echo $X The first one still seems to work on Mac OS X after install the bash fix, however neither seem ...
0
votes
1answer
138 views

Is there any need to take further action over ShellShock [closed]

The question on this site: "When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?" explains how the vulnerability has been cured, but does not, as far ...
2
votes
1answer
1k views

Updating bash against shellshock on Linux Mint 16

Apparently the LM package manager person is on holiday, so even an up-to-date Mint 16 box is vulnerable to the original Shellshock CVE. How do you update such a system meanwhile?
1
vote
1answer
4k views

Which Debian patches fixes shellshock lcamtuf CVE-2014-6277 and CVE-2014-6278? [closed]

Note that this question is definitely not a duplicate of: When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it? According to: https://security-...
2
votes
1answer
2k views

shellshock solution for nexenta/solaris

I'm trying to solve the shellshock issue on my system: SunOS localhost 5.11 NexentaOS_134f i86pc i386 i86pc Solaris # bash --version GNU bash, version 3.2.48(1)-release (i386-pc-solaris2.11) ...
9
votes
1answer
682 views

Why does bash even parse/run stuff put in the environment variable?

The shellshock bug in bash works by way of environment variables. Honestly I was suprised by the fact that there is such a feature like: "passing on of function definitions via env vars" Therefore ...
1
vote
2answers
2k views

Is FreeBSD's “sh” shell vulnerable to Shellshock?

I've got a server for personal use running FreeBSD 10, and it doesn't have Bash installed and never did. However, it comes with the its own POSIX-compliant shell "sh". Do I have to worry about the ...
6
votes
3answers
3k views

Do I have to reboot after updating bash to avoid shellshock?

I've updated my systems to the latest versions of bash (Fedora: bash-4.2.48-2.fc19.x86_64 and CentOS: bash-4.1.2-15.el6_5.2.x86_64) Is merely updating enough to avoid the exploit or do I need to then ...
11
votes
4answers
11k views

Legacy Debian versions and Bash Shellshock

We are running Debian Etch, Lenny and Squeeze because upgrades have never been done in this shop; we have over 150 systems running various Debian versions. In light of the "shell shock" of this week,...
9
votes
2answers
242 views

Why is the ability to define functions in an environmental variable not a security risk in itself?

As I understand it, generally it is considered safe to let anyone provide information that will be stored in an environmental variable. The shellshock vulnerability is an issue here because it means ...
6
votes
5answers
10k views

How do I update bash on EOL Ubuntu versions?

I.e. can I find a close enough package in the next nearest distro? Or is it complicated, and compiling from source is better? Or can I grab it from debian? (This question is about at least Ubuntu 11....
2
votes
2answers
207 views

Correct way to find this (shellshock patch) package?

I was out to patch some squeeze servers for the shellshock bug. A few googles later I found that I could updated my apt sources list. This did however not work for some reason. I tried to search for ...
2
votes
0answers
2k views

How to test shellshock against remote machine using a simple script [closed]

I am interested in testing for shellshock vulnerable machines that I don't have shell access to on my LAN's and WAN's such as IPMI cards and Internet of Things devices. What is the best way to ...
1
vote
2answers
229 views

How does the latest “Bash Bug” or exploit affect systems that require authentication?

I'm curious to know how the latest Bash Bug affects systems that require a user login to access the shell. Isn't UNIX/Linux usually configured in a way that you have to be an authenticated user to ...
8
votes
2answers
10k views

How to apply the fix for CVE-2014-6271 bash vulnerability on cygwin?

I would like to find out how do I apply the fix for this vulnerability on cygwin. I am running the CYGWIN_NT-6.1 MYHOSTNAME 1.7.30(0.272/5/3) 2014-05-23 10:36 x86_64 Cygwin of cygwin on Windows 7. ...
67
votes
3answers
60k views

how can shellshock be exploited over SSH?

Apparently, the shellshock Bash exploit CVE-2014-6271 can be exploited over the network via SSH. I can imagine how the exploit would work via Apache/CGI, but I cannot imagine how that would work over ...
7
votes
1answer
5k views

What is the severity of the new bash exploit (shellshock)? [duplicate]

I've been reading up about the remote bash exploit and was wondering how severe it is and if I should be worried, especially since a new exploit has been found after the patch release. What does this ...
7
votes
1answer
1k views

How does `env X='() { (a)=>\' sh -c “echo date”` work?

After reading about the latest bash vulnerability, I was wondering how Tavis Ormandy's exploit works. How does (a)=>\ work? He posted: The bash patch seems incomplete to me, function parsing is ...
4
votes
3answers
5k views

CVE-2014-6271 Bash Vulnerability example [duplicate]

I am trying to understand what could be the security concern of CVE-2014-6271 and all the links I see just gives me the below command. env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ...
121
votes
2answers
20k views

When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it?

Some context about the bug: CVE-2014-6271 Bash supports exporting not just shell variables, but also shell functions to other bash instances, via the process environment to (indirect) child ...
234
votes
5answers
107k views

What does env x='() { :;}; command' bash do and why is it insecure?

There is apparently a vulnerability (CVE-2014-6271) in bash: Bash specially crafted environment variables code injection attack I am trying to figure out what is happening, but I'm not entirely sure ...