Questions tagged [bash]

The Bourne-again shell (Bash) is a unix shell. It lets the user run commands on the host machine in as a text based program. Questions using this tag should either be related to vulnerabilities of bash or proper use of specific commands.

Filter by
Sorted by
Tagged with
76
votes
6answers
69k views

Is there a short command to test if my server is secure against the shellshock bash bug?

I did apt-get update; apt-get upgrade -y on all systems I'm running. I'm not sure if my /etc/apt/sources.list is good enough on all of these systems. I would like to quickly check each system again, ...
203
votes
15answers
285k views

Provide subjectAltName to openssl directly on the command line

Is it possible to provide a subjectAltName-Extension to the openssl req module directly on the command line? I know it's possible via a openssl.cnf file, but that's not really elegant for batch-...
212
votes
5answers
152k views

What is a specific example of how the Shellshock Bash bug could be exploited?

I read some articles (article1, article2, article3, article4) about the Shellshock Bash bug (CVE-2014-6271 reported Sep 24, 2014) and have a general idea of what the vulnerability is and how it could ...
22
votes
1answer
10k views

Attack scenarios of the new Bash vulnerability [duplicate]

Odds are that you're already aware of the newly discovered Bash bug. It can be tested using env x='() { :;}; echo vulnerable' bash -c "echo this is a test". What yet I haven't understand is, what ...
43
votes
4answers
39k views

How do I secure Apache against the Bash Shellshock vulnerability?

I have an Apache webserver running, and with the recent news of the Shellsock exploit against bash I was wondering if my webserver is vulnerable. I don't think it is, but I want to make sure I'm not ...
41
votes
3answers
23k views

Are ordinary OS X desktops at risk from bash “shellshock” bug (CVE-2014-6271)?

I've recently heard via Twitter about CVE-2014-6271. Are ordinary OS X desktops, that aren't acting as a web server, at risks of receiving attacks that could exploit this vulnerability?
22
votes
1answer
7k views

GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though?

After the news of the Shellshock vulnerability broke out, I remembered I had GitHub's version of a bash shell for Windows installed. Just to see if it also had the vulnerability, I executed: env x='()...
9
votes
4answers
6k views

What do shellshock attacks look like in system logs? [closed]

I have some Linux servers, which from what I can tell are not vulnerable to the shellshock attack vector, but I am curious what the attack looks like in the logs. What does a successful attack look ...
1
vote
2answers
1k views

Shellshock plus sudo/su environment whitelist bypass - big problem?

The question is: How big a problem is this? Looks pretty big to me. With the shellshock bug it is possible to bypass the whitelist of known-harmless environment variables in sudo, as well as other ...
7
votes
2answers
1k views

Do sudo and .profile/.bashrc enable trivial privilege escalation?

First of all, let me mention that I’m assuming a configuration as set up by current Linux desktop distributions (e. g. Debian, Fedora). I’m sure that there are methods which, if implemented, would ...
15
votes
5answers
5k views

Can a .sh file be malware?

Can a .sh file be a virus or something harmful? Is it like .exe files on Windows? If yes, can someone read this script and tell me if it safe and is it effect any how on GnuPG security? It gives me an ...
10
votes
2answers
8k views

Does shellshock produce a comprehensive local privilege escalation vector?

If setuid scripts take arbitrary environment variables, apart from a few black-listed ones like LD_LIBRARY_PATH, from the caller, does this not mean that any setuid script running #!/bin/bash directly ...
7
votes
5answers
12k views

Shellshock attack scenario exploiting php

I've seen attack scenarios involving using wget on cgi-scripts, but how about a scenario exploiting a web server php script that issues an exec() or system() call to a bash script? As far as I can ...
1
vote
1answer
877 views

What can an attacker do in this scenario? (unwritable bashrc, profile, etc.) [closed]

Scenario: Typical Linux desktop setup: unprivileged user but with sudo capabilities to do basically everything For the sake of argument let's forget about X11 and its way to allow trivial keyloggers, ...
23
votes
2answers
2k views

What vulnerability is targeted by an HTTP referer starting with (){ :;};/bin/bash

I found this code, followed by several bash commands downloading and running a payload from the web, in the referer field in my apache error logs. The attack appears to work by converting a command ...
2
votes
1answer
2k views

Is server exploitable by Shellshock with cgi-enabled only?

A server with vulnerable bash, but cgi enabled only and there are no cgi scripts in cgi-bin. Is it still exploitable ?? If there are scripts in cgi-bin and only server-admin knows about filenames of ...
2
votes
0answers
2k views

system(“/bin/sh”) exits without waiting for user input [OverTheWire narnia0 challenge] [closed]

Problem : Why does system("/bin/sh") process exits immediately instead of waiting for user input? Code : int main(){ long val=0x41414141; char buf[20]; printf("Correct val's value from ...
0
votes
2answers
122 views

The most secure way to allow downloading and installing an app on Mac, Windows, or Linux

I have been introduced to the anti-bash-script-piping stuff such as these: Curl Bash Piping Wall of Shame (link broken) Piping curl to s(hell) Don't Pipe to your Shell The hidden dangers of piping ...