Remote exploit vulnerability in bash CVE-2014-6271

[Recursion]

Ouch.

http://www.csoonline.com/article/2687265/application-security/remote-exploit-in-bash-cve-2014-6271.html

A remotely exploitable vulnerability has been discovered by Stephane Chazelas in bash on Linux and it is unpleasant. The vulnerability has the CVE identifier CVE-2014-6271 and has been given the name Shellshock by some. This affects Debian as well as other Linux distributions. You will need to patch ASAP.

Bash supports exporting shell variables as well as shell functions to other bash instances. This is accomplished through the process environment to a child process.

The major attack vectors that have been identified in this case are HTTP requests and CGI scripts.

TL;DR: an environment variable whose value's first three characters are &quot ){" processes as a function definition and will continue to execute any commands after the end of that function definition, eg FOO=&quot ){ls}; rm -rf /home" will define the function FOO and then remove the /home tree.

Ouch.

[defacto7]

1. Yikes

Debian put out a patch almost immediately. Update... especially servers. I did so a couple of hours ago.

[defacto7]

2. The updates yesterday were incomplete...

Bash has another update today which should be utilized..

So update bash again... and hope this is a reasonable patch. Time will tell when they find out what scripts are vulnerable because it takes both bash and certain vulnerable scripts to make an exploit.

There are better links than this but it does the job:

http://www.cbc.ca/news/technology/shellshock-computer-bug-already-exploited-by-hackers-1.2777514?cmp=rss