Linked Questions
15 questions linked to/from Is there a short command to test if my server is secure against the shellshock bash bug?
2
votes
2
answers
4k
views
Git bash shellshock vulnerability [duplicate]
I have installed Git for Windows with bash shell support. Is it vulnerable to ShellShock?
Refs:
GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though?
https://...
- 121
0
votes
1
answer
702
views
Bash attack. Am I vulnerable? [duplicate]
Someone, today, appears to have tried to attack my VPS. I checked my logs and saw this:
54.251.83.67 - - [26/Sep/2014:17:07:02 -0400] "GET / HTTP/1.1" 200 1437 "-" "() { :;}; /bin/bash -c \"echo ...
- 103
-2
votes
1
answer
661
views
How to test the bash CVE-2014-6271? [duplicate]
Question: How do I know that I am affected or not by the bash CVE-2014-6271?
I just have to simply run a command on the server?
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
...
- 127
0
votes
0
answers
91
views
Vulnerability test for CVE-2014-7169 (Shellshock) [duplicate]
I found this test here for the Shellshock vulnerability follow-up CVE-2014-7169 , which is basicaly doing:
echo `env X='() { (a)=>\' sh -c "echo '[Vulnerability CVE-2014-7169 Detected]'" 2> /...
- 2,390
213
votes
5
answers
155k
views
What is a specific example of how the Shellshock Bash bug could be exploited?
I read some articles (article1, article2, article3, article4) about the Shellshock Bash bug (CVE-2014-6271 reported Sep 24, 2014) and have a general idea of what the vulnerability is and how it could ...
- 1,435
41
votes
3
answers
23k
views
Are ordinary OS X desktops at risk from bash "shellshock" bug (CVE-2014-6271)?
I've recently heard via Twitter about CVE-2014-6271.
Are ordinary OS X desktops, that aren't acting as a web server, at risks of receiving attacks that could exploit this vulnerability?
- 2,100
23
votes
2
answers
2k
views
What vulnerability is targeted by an HTTP referer starting with (){ :;};/bin/bash
I found this code, followed by several bash commands downloading and running a payload from the web, in the referer field in my apache error logs. The attack appears to work by converting a command ...
- 335
9
votes
3
answers
6k
views
Shellshock exploit on Linux Routers/Modems?
I am worried about the millions (actually, worried about mine) of routers/modems that run Linux. How exposed are they to Shellshock?
- 407
22
votes
1
answer
11k
views
Attack scenarios of the new Bash vulnerability [duplicate]
Odds are that you're already aware of the newly discovered Bash bug. It can be tested using env x='() { :;}; echo vulnerable' bash -c "echo this is a test".
What yet I haven't understand is, what ...
user15194
7
votes
3
answers
10k
views
How to patch Bash on OSX in wake of "shellshock"? [duplicate]
My Mac is vulnerable, as this test shows:
x='() { :;}; echo VULNERABLE' bash -c : (source)
I am using the version of bash that came with it. I also use Homebrew. What is the preferred way to patch ...
- 233
2
votes
2
answers
982
views
Did this ShellShock exploit work?
Looking through my web server logs, I noticed two different ShellShock attacks on my server, both of which generated a HTTP 200 OK response code. They look like this (IP address/date and time redacted)...
- 123
1
vote
1
answer
363
views
Apache logs show commands execution
I am wondering if my server is compromised or not. I just looked at my log and seen the following line in there:
IP: 173.249.4.160, Date: 27-12-17, Time:09:52:51, Browser: () { :;}; /bin/bash -c "...
- 33
2
votes
1
answer
384
views
Has CVE-2014-6271 Shell Shock been mitigated completely what is the latest? [closed]
I have patched my system however CVE-2014-7169 claims that the fix for 6271 was incomplete. Sure enough if I run the command below:
env X='() { (a)=>\' sh -c "echo date"; cat echo
It appears that ...
- 2,727
2
votes
1
answer
219
views
Why "() { :;};"?
I was wanting to understand why the code below serves as a proof-of-concept for telling me whether my server is vulnerable or not. Moreover, how does the vulnerability work at lower-level?
$ env 'x=()...
- 21
0
votes
1
answer
109
views
Linux Updates to Shellshock
My question is about the community response to Shellshock.
What improvements were made in either the Linux development cycle or in the recommendation to its users to prevent something like Shellshock/...
- 101