A newly discovered security bug in a widely used piece of Linux software, known as \u201cBash,\u201d could pose a bigger threat to computer users than the \u201cHeartbleed\u201d bug that surfaced in April, cyber experts warned on Wednesday.<\/p>\n
The bug was rated a \u201c10\u201d for severity, meaning it has maximum impact, and rated \u201clow\u201d for complexity of exploitation, meaning it is relatively easy for hackers to launch attacks.<\/p>\n
\u201cUsing this vulnerability, attackers can potentially take over the operating system, access confidential information, make changes, etc. \u201cAnybody with systems using Bash needs to deploy the patch immediately.\u201d<\/p>\n
\u201cHeartbleed,\u201d discovered in April, is a bug in an open-source encryption software called OpenSSL. <\/p>\n
The Shellshock vulnerability can be exploited on systems that are running Services or applications that allow unauthorized remote users to assign Bash environment variables. Examples of exploitable systems include the following:<\/p>\n
Apache HTTP Servers that use CGI scripts (via mod_cgi and mod_cgid) that are written in Bash or launch to Bash subshells
\nCertain DHCP clients
\nOpenSSH servers that use the ForceCommand capability
\nVarious network-exposed services that use Bash<\/p>\n
Check System Vulnerability<\/strong><\/p>\n On each of your systems that run Bash, you may check for Shellshock vulnerability by running the following command at the bash prompt:<\/p>\n env VAR='() { :;}; echo Bash is vulnerable!’ bash -c “echo Bash Test” Bash is vulnerable! bash: warning: VAR: ignoring function definition attempt Fix Vulnerability: Update Bash<\/strong><\/p>\n Use your default package manager to update the version of Bash. The following subsections cover updating Bash on various Linux distributions, including Ubuntu, Debian, CentOS, Red Hat, and Fedora.<\/p>\n YUM: CentOS \/ Red Hat \/ Fedora<\/strong><\/p>\n Update Bash to the latest version available via the yum:<\/p>\n sudo yum update bash<\/p>\n Now run check your system vulnerability again by running the command in the previous section<\/p>\n","protected":false},"excerpt":{"rendered":" A newly discovered security bug in a widely used piece of Linux software, known as \u201cBash,\u201d could pose a bigger threat to computer users than the \u201cHeartbleed\u201d bug that surfaced in April, cyber experts warned on Wednesday. The bug was rated a \u201c10\u201d for severity, meaning it has maximum impact, and rated \u201clow\u201d for complexity … Continue reading “Shellshock Bash Vulnerability. Severe than HEARTBLEED Bug.”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-229","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/linuxmaster.in\/index.php?rest_route=\/wp\/v2\/posts\/229","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/linuxmaster.in\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/linuxmaster.in\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/linuxmaster.in\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/linuxmaster.in\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=229"}],"version-history":[{"count":2,"href":"https:\/\/linuxmaster.in\/index.php?rest_route=\/wp\/v2\/posts\/229\/revisions"}],"predecessor-version":[{"id":231,"href":"https:\/\/linuxmaster.in\/index.php?rest_route=\/wp\/v2\/posts\/229\/revisions\/231"}],"wp:attachment":[{"href":"https:\/\/linuxmaster.in\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=229"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/linuxmaster.in\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=229"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/linuxmaster.in\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=229"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nThe highlighted echo Bash is vulnerable! portion of the command represents where a remote attacker could inject malicious code; arbitrary code following a function definition within an environment variable assignment. Therefore, if you see the following output, your version of Bash is vulnerable and should be updated:<\/p>\n
\nBash Test
\nOtherwise, if your output does not include the simulated attacker’s payload, i.e. “Bash is vulnerable” is not printed as output, your version of bash is not vulnerable. It may look something like this:<\/p>\n
\nbash: error importing function definition for `VAR’
\nBash Test<\/p>\n