0

Someone, today, appears to have tried to attack my VPS. I checked my logs and saw this:

54.251.83.67 - - [26/Sep/2014:17:07:02 -0400] "GET / HTTP/1.1" 200 1437 "-" "() { :;}; /bin/bash -c \"echo testing9123123\"; /bin/uname -a"

Am I vulnerable? If not, how could I tell if I was? I updated to the latest update earlier before the above happened and did a test which came back as an error.

Improve this question
1
  • @Xander See comment in answer below.
    – Chris Burton
    Sep 26, 2014 at 21:28

1 Answer 1

Reset to default
1

You can't tell from that log entry if you're vulnerable or not. If you're not vulnerable, there may be a corresponding entry in Apache's error log with lines similar to

bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'

However, the error message will only show up if your site's root webpage can be used as an attack vector. If you're serving a static page, or a dynamic page that doesn't invoke Bash, there will be no error message.

Basically, the best evidence that you're not vulnerable is that you updated before the probe attempt took place.

Improve this answer
1
  • Thanks! The reason I asked is because after I updated I was trying to install some software (HHVM) and now basic commands are not working. I just wanted to make sure I didn't override or lose anything security wise.
    – Chris Burton
    Sep 26, 2014 at 21:26

Not the answer you're looking for? Browse other questions tagged .