#bashbug

Bash, 2 nouvelles vulnérabilités identifiée, nouveau correctif

Bonjour à tous, 2 nouvelles vulnérabilités ont été détectées dans le bash. Il s’agit de 2 buffer overflow dans parse.y. Encore une fois, j’ai préparé une nouvelle version de batch patchée pour des versions qui peuvent n’être plus maintenues par les éditeurs.

Ce patch fonctionne correctement sur Mandriva 2008 à 2010.2, OpenSUSE 12.1 Asparagus 64 bits & Red Hat Enterprise Linux Server release 5.2…

#Shellshock Bash and #Bashbug Vulnerability

I’m sure most of you are familiar with the Heartbleed vulnerability with OpenSSL and how it has affected most of the applications and systems across the internet. Well a new vulnerability has appeared and is potentially much worse. While this vulnerability is new to the public it has been a “bug” for over 25 years and is just now being exploited on a much larger scale.

Shellshock Video:

Her…

the recent vulnerability discovered in linux servers, shellshock / bash bug , can be easily fixed by running a few simple commands, basically updating your version of bash and testing if your server is vulnerable to the attack.

As you might have heard there's a big vulnerability called ShellShock or BashBug in the bash shell that affects all unix based systems such as linux and osx.

The vulnerability allows an outside to execute any code on your system remotely.

To test if you are vulnerable run the following in your shell:

env x='() { :;}; echo vulnerable' bash -c 'echo hello'

Luckily there are already updates that fix the vulnerability.

On ubuntu run the following command: sudo apt-get update && sudo apt-get install --only-upgrade bash

On Redhat: sudo yum update bash

On osx: http://apple.stackexchange.com/questions/146849/how-do-i-recompile-bash-to-avoid-shellshock-the-remote-exploit-cve-2014-6271-an

In Terminal or CLI type 

env x='() { :;}; echo vulnerable' bash -c 'echo hello'

If you don't have the Patch it will output 

vulnerable

hello

if you have installed the patch it will output

bash: warning: x: ignoring function definition attempt