The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My work

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,822 other followers

bash vulnerability; patch your *n*x boxes A.S.A.P. (via: CERT/NIST reveal level 10 bash alert today, 24 September 2014)

Posted by jpluimers on 2014/09/25

Unpatched bash allows for remote code execution.

Patch as soon as you can and be aware that the current patches might not be complete.

Many vendors (including Debian, Red Hat, SuSE, Ubuntu) already have patches available: CERT/NIST reveal level 10 bash alert today, 24 September 2014.

This is a long article which explains the why/how/… and has an easy check to see if you are vulnerable: What is the CVE-2014-6271 bash vulnerability and, how do I fix it.

It looks like the current patches aren’t complete yet, but do plug big parts of the hole.

Watch bash CVEs in Ubuntu and CVE-2014-7169 in Ubuntu (and maybe for other nx varieties as well).

Update:

Quote from the article:

Am I vulnerable?

Edit for the time being: You are. No complete public fix has been posted yet. The instructions I give below are only sufficient to close off part of the vulnerability.

There is an easy check. Open a terminal and paste the following:

env x='() { :;}; echo vulnerable' bash -c 'echo hello'

If you are not vulnerable, then the following will be shown:

bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
hello

If you are vulnerable, then you will see:

vulnerable
hello

–jeroen

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: