Solved

Shellshock bug

Posted on 2014-09-26
5
431 Views
Last Modified: 2014-10-17
Hi Guys,

I have a couple of Linux Debian 6.0.2 and I'm trying to update bash.  When I run:

====
apt-get install --only-upgrade bash
====

It comes back saying:

=====
Reading package lists... Done
Building dependency tree
Reading state information... Done
bash is already the newest version.
=====

However when I execute the command to test this Shellshock bug:

=====
env x='() { :;}; echo vulnerable'  bash -c "echo this is a test"
=====

It still comes back with:

=====
vulnerable
this is a test
=====

My question is:

1. Is there a patch for bash for Debian 6 at the moment?
2. If not, are there any other precautions I can take to mitigate such an attack?

I've already change the SSH port from the default 22 and have only allowed accesss
to certain IP address.

Please don't tell me I need to upgrade from Debian 6 to 7 for this to work unless this is the only fix.

Many Thanks
0
Comment
Question by:markbenham
  • 3
5 Comments
 

Author Comment

by:markbenham
Comment Utility
Hi Guys,

I may have sorted this problem out on Debian 6 (squeeze).
Here is what I did:

Add these 2 lines into /etc/apt/sources.list

deb http://http.debian.net/debian/ squeeze-lts main contrib non-free
deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free

Next I ran:

apt-get update

Follwed by:

apt-get install --only-upgrade bash

Once completed, I executed the command to test the Shellshock bug:

=====
env x='() { :;}; echo vulnerable'  bash -c "echo this is a test"
=====

And this this time it came back with:

=====
this is a test
=====

I'm assuming that because it had NOT returned:

=====
vulnerable
this is a test
=====

and Just:

====
this is a test
====

Then this is fine...?

Many thanks.
0
 
LVL 29

Expert Comment

by:Rich Weissler
Comment Utility
That looks good, but keep an eye out.  Apparently the initial patch logic is 'incomplete': Internet Storm Center diary update on ShellShock  The article includes a second test... which reports failure, but still writes a file.
0
 
LVL 61

Assisted Solution

by:btan
btan earned 500 total points
Comment Utility
best to verify as there are couple of exploit revolving ShellShock
Exploit 1 (CVE-2014-6271) - this is test you run as shared (early patch was incomplete)
e.g. env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
If you see "vulnerable" you need to update bash. Otherwise, you should be good to go.

Exploit 2 (CVE-2014-7169) - here is another
e.g. env X='() { (a)=>\' bash -c "echo date"; cat echo ; rm -f echo
If the above command outputs the current date (it may also show errors), you are still vulnerable.

there is another exploit (e.g. env -i X=' () { }; echo hello' bash -c 'date') mention in https://shellshocker.net/#fix
This third seems to be still active w/o patch.
There is bash patch history stated in a/m link

in case this come handy
http://cloudgames.com/blog/fix-bash-exploit-old-new-releases-ubuntu-apt-get/
How to fix shellshock on old and new Debian versions

For Debian the solution is identical, but you’ll have to update your sources to codename wheezy, which is the latest Debian release code name, instead of trusty. So your search and replace line would become something like this:

sudo sed -i 's/YOUR_OS_CODENAME_HERE/wheezy/g' /etc/apt/sources.list
0
 
LVL 61

Expert Comment

by:btan
Comment Utility
there has been more related CVE to the Shellshock so check out the latest patch again
- you can check out latest patch based on CVE in https://security-tracker.debian.org/tracker
e.g. https://security-tracker.debian.org/tracker/CVE-2014-7169
- check out the CVE under wiki too http://en.wikipedia.org/wiki/Shellshock_(software_bug)
and the archive of bash patch in http://ftp.gnu.org/gnu/bash/ for info
0
 
LVL 61

Accepted Solution

by:
btan earned 500 total points
Comment Utility
to share in forum, this has more info and test script to check out the latest CVEs too and steps for the patching including the debian lts @ https://dmsimard.com/2014/09/25/the-bash-cve-2014-6271-shellshock-vulnerability/
0

Featured Post

Free camera licenses with purchase of My Cloud NAS

Milestone Arcus software is compatible with thousands of industry-leading cameras for added flexibility. Upon installation on your My Cloud NAS, you will receive two (2) camera licenses already enabled in the software. And for a limited time, get additional camera licenses FREE.

Join & Write a Comment

Suggested Solutions

Recently, I read that Microsoft has analysed statistics for their security intelligence report. It revealed: still, the clear majority of windows users do their daily work as administrator. An administrative account is a burden, security-wise. My ar…
Transferring data across the virtual world became simpler but protecting it is becoming a real security challenge.  How to approach cyber security  in today's business world!
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Connecting to an Amazon Linux EC2 Instance from Windows Using PuTTY.

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now