Linked Questions

2 votes
2 answers

Git bash shellshock vulnerability [duplicate]

I have installed Git for Windows with bash shell support. Is it vulnerable to ShellShock? Refs: GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though? https://...
rageit's user avatar
  • 121
0 votes
1 answer

Bash attack. Am I vulnerable? [duplicate]

Someone, today, appears to have tried to attack my VPS. I checked my logs and saw this: - - [26/Sep/2014:17:07:02 -0400] "GET / HTTP/1.1" 200 1437 "-" "() { :;}; /bin/bash -c \"echo ...
Chris Burton's user avatar
-2 votes
1 answer

How to test the bash CVE-2014-6271? [duplicate]

Question: How do I know that I am affected or not by the bash CVE-2014-6271? I just have to simply run a command on the server? $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ...
somelooser28533's user avatar
0 votes
0 answers

Vulnerability test for CVE-2014-7169 (Shellshock) [duplicate]

I found this test here for the Shellshock vulnerability follow-up CVE-2014-7169 , which is basicaly doing: echo `env X='() { (a)=>\' sh -c "echo '[Vulnerability CVE-2014-7169 Detected]'" 2> /...
rubo77's user avatar
  • 2,390
213 votes
5 answers

What is a specific example of how the Shellshock Bash bug could be exploited?

I read some articles (article1, article2, article3, article4) about the Shellshock Bash bug (CVE-2014-6271 reported Sep 24, 2014) and have a general idea of what the vulnerability is and how it could ...
Rob Bednark's user avatar
  • 1,435
41 votes
3 answers

Are ordinary OS X desktops at risk from bash "shellshock" bug (CVE-2014-6271)?

I've recently heard via Twitter about CVE-2014-6271. Are ordinary OS X desktops, that aren't acting as a web server, at risks of receiving attacks that could exploit this vulnerability?
Andrew Grimm's user avatar
  • 2,100
23 votes
2 answers

What vulnerability is targeted by an HTTP referer starting with (){ :;};/bin/bash

I found this code, followed by several bash commands downloading and running a payload from the web, in the referer field in my apache error logs. The attack appears to work by converting a command ...
Kylos's user avatar
  • 335
9 votes
3 answers

Shellshock exploit on Linux Routers/Modems?

I am worried about the millions (actually, worried about mine) of routers/modems that run Linux. How exposed are they to Shellshock?
noderman's user avatar
  • 407
22 votes
1 answer

Attack scenarios of the new Bash vulnerability [duplicate]

Odds are that you're already aware of the newly discovered Bash bug. It can be tested using env x='() { :;}; echo vulnerable' bash -c "echo this is a test". What yet I haven't understand is, what ...
user avatar
7 votes
3 answers

How to patch Bash on OSX in wake of "shellshock"? [duplicate]

My Mac is vulnerable, as this test shows: x='() { :;}; echo VULNERABLE' bash -c : (source) I am using the version of bash that came with it. I also use Homebrew. What is the preferred way to patch ...
Alex Shroyer's user avatar
2 votes
2 answers

Did this ShellShock exploit work?

Looking through my web server logs, I noticed two different ShellShock attacks on my server, both of which generated a HTTP 200 OK response code. They look like this (IP address/date and time redacted)...
Ocracoke's user avatar
  • 123
1 vote
1 answer

Apache logs show commands execution

I am wondering if my server is compromised or not. I just looked at my log and seen the following line in there: IP:, Date: 27-12-17, Time:09:52:51, Browser: () { :;}; /bin/bash -c "...
Bruteforce 's user avatar
2 votes
1 answer

Has CVE-2014-6271 Shell Shock been mitigated completely what is the latest? [closed]

I have patched my system however CVE-2014-7169 claims that the fix for 6271 was incomplete. Sure enough if I run the command below: env X='() { (a)=>\' sh -c "echo date"; cat echo It appears that ...
user53029's user avatar
  • 2,727
2 votes
1 answer

Why "() { :;};"?

I was wanting to understand why the code below serves as a proof-of-concept for telling me whether my server is vulnerable or not. Moreover, how does the vulnerability work at lower-level? $ env 'x=()...
James's user avatar
  • 21
0 votes
1 answer

Linux Updates to Shellshock

My question is about the community response to Shellshock. What improvements were made in either the Linux development cycle or in the recommendation to its users to prevent something like Shellshock/...
Chris Cooney's user avatar