I just tested whether or not my university's environment was vulnerable to the shellshock bug using env X="() { :;} ; echo busted" /bin/sh -c "echo stuff" (code from http://www.troyhunt.com/2014/09/everything-you-need-to-know-about.html)

The output was stuff, as such the environment isn't vulnerable to the shellshock bug. However it is a bash environment so why what possible reasons are there for it not being vulnerable?

  • 1
    They patched it in the last 24 hours or you would have gotten busted as well as stuff.
    – zedman9991
    Sep 25, 2014 at 20:41

2 Answers 2


It sounds as though your systems may have been patched already. If you want to perform more due diligence, you would have to check the version of bash against the patched versions. You can do this with the command bash --version or echo $BASH_VERSION. At that point I would consult your distro's documentation to ensure the version appears to match the patched version.


There are two possibilities:

  • /bin/sh may not be bash on this system. It's common to have bash (or sometimes zsh) as the default interactive shell on account creation, but dash or ksh as /bin/sh. For example, on Ubuntu, /bin/sh is dash, not bash, but accounts are created with /bin/bash as their login shell by default.
  • Maybe your university has already applied the security fix.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .