2

I just tested whether or not my university's environment was vulnerable to the shellshock bug using env X="() { :;} ; echo busted" /bin/sh -c "echo stuff" (code from http://www.troyhunt.com/2014/09/everything-you-need-to-know-about.html)

The output was stuff, as such the environment isn't vulnerable to the shellshock bug. However it is a bash environment so why what possible reasons are there for it not being vulnerable?

  • 1
    They patched it in the last 24 hours or you would have gotten busted as well as stuff. – zedman9991 Sep 25 '14 at 20:41
1

It sounds as though your systems may have been patched already. If you want to perform more due diligence, you would have to check the version of bash against the patched versions. You can do this with the command bash --version or echo $BASH_VERSION. At that point I would consult your distro's documentation to ensure the version appears to match the patched version.

|improve this answer|||||
1

There are two possibilities:

  • /bin/sh may not be bash on this system. It's common to have bash (or sometimes zsh) as the default interactive shell on account creation, but dash or ksh as /bin/sh. For example, on Ubuntu, /bin/sh is dash, not bash, but accounts are created with /bin/bash as their login shell by default.
  • Maybe your university has already applied the security fix.
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.