The maintainers of the Openwall security enhanced Linux distribution have released a new stable version, which includes fixes for a number of serious vulnerabilities, such as the Shellshock Bash bug and the flaw in SSLv3 that leads to the POODLE attack. Openwall is designed to be a small, compact Linux distribution for servers, appliances and […]
Tag Archives: Bash bug
Yahoo told to “pull your pants up†after Shellshock hack claims
Yesterday, security researcher Jonathan Hall, of a company called Future South Technologies, accused Yahoo of having suffered a serious security breach via the recently discovered Shellshock vulnerability in Bash.
The post Yahoo told to “pull your pants up” after Shellshock hack claims appeared first on We Live Security.
Threatpost News Wrap, October 3, 2014
Dennis Fisher and Mike Mimoso talk about the Bash Shellshock bug nightmare and the BadUSB code release.
VMware Begins to Patch Bash Issues Across Product Line
VMware issued a progress report on fixes for four different types of products as they relate to the Bash vulnerability.
What is the Bash bug, and how do I prevent my systems from being Shellshocked?
Shellshock is a newly discovered security flaw that has been around for 22 years, and works by exploiting the very nature of web GUI.
Working in the same way as SQL injection, Shellshock allows users to insert Bash (a Unix-based command processor, or shell) commands into a server via a web form or similar method, and exploits the very nature of environment variable handling, which is that after assigning a function to a variable, any trailing code in the function will be then executed.
Where the SQL injection vulnerability allows a hacker access to the database, Shellshock gives the hacker an authentication-free access to the server, which makes it much more powerful. With this type of access, one with malicious intent could create a worm that could multiply and reproduce the exploit across entire networks to collect or modify data, or open other security holes that would otherwise be closed. Though Bash does not natively run on Microsoft Windows machines, it can be ported, but it is not yet known if the vulnerability will remain present.
Ok, so I get it, itâs dangerous. Am I vulnerable?
Absolutely.
Why?
Because Unix has a much wider grip on our networks than most people can really appreciate. Due to its ubiquity, everything from routers and smartphones, TVs, cars and more could be exploited. Worse, is that many of those devices are very difficult to update. Your home router, for example, has control of all your incoming and outgoing network traffic, and if someone has that, not only do they have the potential to collect your data, but to enable ports, disable the firewall, and further their access into your network infrastructure. With that being said, if you are running any versions of Unix or Mac, and havenât familiarized yourself with this vulnerability, youâre well overdue.
Luckily, many vendors have now patched for Shellshock by updating Bash, but at this time, Apple users should wait for an update.
Iâm running Unix. What do I do now?
First, itâs best to find out if youâre affected. Specifically, are you running Redhat, Ubuntu, Fedora, CentOS (v5-7) CloudLinux, or Debian? If so, then run this command to find out if youâre vulnerable.
$ env x=’() { :;}; echo vulnerable’ bash -c “echo this is a test”
If you see nothing but âthis is a test,â youâve successfully run the exploit, and youâve got some work to do.
Luckily, most Linux distributions have issued fixes, so you can simply run your update manager. For those who havenât, you can do so manually by running the following commands:
yum update bash
OR
sudo apt-get update && sudo apt-get install bash
Help, I have a Mac!
Are you infected? Run this command from your shell and find out.
$ env x=’() { :;}; echo vulnerable’ bash -c ‘echo hello’
If youâve got Mac machines in your environment that can be exploited, you can disable the exploit by temporarily changing the default user shell. For IT administrators that have the know-how, get started right away – but for those that have to ask âhow?,â itâs best to keep your eyes peeled and wait for an official update from Apple.
Thank you for using avast! Antivirus and recommending us to your friends and family. For all the latest news, fun and contest information, please follow us on Facebook, Twitter and Google+. Business owners â check out our business products.