A vulnerably has been discovered affecting many different devices running Unix/Linux based distros. The exploit could possibly allow an attacker to remotely execute arbitrary code on your system. To check to see if your system(s) have been infected follow the directions below.
On each of your systems that run Bash, you may check for Shellshock vulnerability by running the following command at the bash prompt:
env VAR='() { :;}; echo Bash is vulnerable!' bash -c "echo Bash Test"
The highlighted echo Bash is vulnerable! portion of the command represents where a remote attacker could inject malicious code;
arbitrary code following a function definition within an environment variable assignment. Therefore, if you see the following output, your version of Bash is vulnerable and should be updated:
Bash is vulnerable!
Bash Test
Bash Test
Otherwise, if your output does not include the simulated attacker's payload, i.e. "Bash is vulnerable" is not printed as output, your version of bash is not vulnerable. It may look something like this:
bash: warning: VAR: ignoring function definition attempt
bash: error importing function definition for `VAR'
Bash Test
bash: error importing function definition for `VAR'
Bash Test
If your version of Bash is vulnerable, enter the following command into the terminal to fix it (for debian/ubuntu systems, syntax may vary for other distros or operating systems):
sudo apt-get update && sudo apt-get install --only-upgrade bash
After updating your version of BASH, you are good to go! Stay up to date, and stay safe. Just to clarify, this discovery does not mean that Linux is insecure, in fact, the immediate update from the open-source Linux community tells us quite the contrary. We, (the people that use AND develope the systems we love) immediately issued a patch to fix this bug as soon as it was discovered. If this was a Microsoft problem, chances are that you would not receive an update for at least another month, because the people that work for Microsoft have little self interest in making their product secure, as they only want your money. Long Live Linux!
No comments:
Post a Comment