NST Shellshock Detection - Revision history

Rwh at 12:53, 30 September 2014

2014-09-30T12:53:00Z

← Older revision		Revision as of 08:53, 30 September 2014
Line 49:		Line 49:
	There is NO WARRANTY, to the extent permitted by law.		There is NO WARRANTY, to the extent permitted by law.
	[user@nst ~]$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'		[user@nst ~]$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'
	~~bash: warning: x: ignoring function definition attempt~~		hello
	~~bash: error importing function definition for `x'~~
	hello
	[user@nst ~]$		[user@nst ~]$

	The lack of the "''vulnerable''" output indicates that the updated version of '''bash''' has been patched and is no longer contains the ''Shellshock'' vulnerability.		The lack of the "''vulnerable''" output indicates that the updated version of '''bash''' has been patched and is no longer contains the ''Shellshock'' vulnerability.

Rwh at 12:51, 30 September 2014

2014-09-30T12:51:26Z

← Older revision		Revision as of 08:51, 30 September 2014
Line 49:		Line 49:
	There is NO WARRANTY, to the extent permitted by law.		There is NO WARRANTY, to the extent permitted by law.
	[user@nst ~]$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'		[user@nst ~]$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'
	bash: warning: x: ignoring function definition attempt		bash: warning: x: ignoring function definition attempt
	bash: error importing function definition for `x'		bash: error importing function definition for `x'
	hello		hello
	[user@nst ~]$		[user@nst ~]$

	The lack of the "''vulnerable''" output indicates that the updated version of '''bash''' has been patched and is no longer contains the ''Shellshock'' vulnerability.		The lack of the "''vulnerable''" output indicates that the updated version of '''bash''' has been patched and is no longer contains the ''Shellshock'' vulnerability.

Rwh at 12:51, 30 September 2014

2014-09-30T12:51:06Z

← Older revision		Revision as of 08:51, 30 September 2014
Line 49:		Line 49:
	There is NO WARRANTY, to the extent permitted by law.		There is NO WARRANTY, to the extent permitted by law.
	[user@nst ~]$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'		[user@nst ~]$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'
			bash: warning: x: ignoring function definition attempt
			bash: error importing function definition for `x'
	hello		hello
	[user@nst ~]$		[user@nst ~]$

	The lack of the "''vulnerable''" output indicates that the updated version of '''bash''' has been patched and is no longer contains the ''Shellshock'' vulnerability.		The lack of the "''vulnerable''" output indicates that the updated version of '''bash''' has been patched and is no longer contains the ''Shellshock'' vulnerability.

Paul Blankenbaker at 12:27, 29 September 2014

2014-09-29T12:27:11Z

← Older revision		Revision as of 08:27, 29 September 2014
Line 23:		Line 23:
	= Shellshock Removal =		= Shellshock Removal =

	To remove the ''Shellshock'' vulnerability, you will need to update the version of the '''bash''' shell installed on your system. For a NST 20 based distribution (or any Fedora 20 based distribution), you can ~~run~~ the following command:		To remove the ''Shellshock'' vulnerability, you will need to update the version of the '''bash''' shell installed on your system. For a NST 20 based distribution (or any Fedora 20 based distribution), you can accomplish this by running the following command:

	~~[user@nst ~]$ sudo yum update~~
	[user@nst ~]$ sudo yum update		[user@nst ~]$ sudo yum update
	[sudo] password for user:		[sudo] password for user:

Paul Blankenbaker: Created page with "TOC This page shows how to test whether the version of bash installed on your '''NST''' system has the '''[http://www.symantec.com/connect/blogs/shellshock-all-you-need-k..."

2014-09-29T12:26:11Z

Created page with "__TOC__ This page shows how to test whether the version of bash installed on your '''NST''' system has the '''[http://www.symantec.com/connect/blogs/shellshock-all-you-need-k..."

New page

__TOC__

This page shows how to test whether the version of bash installed on your '''NST''' system has the '''[http://www.symantec.com/connect/blogs/shellshock-all-you-need-know-about-bash-bug-vulnerability?om_sem_cid=biz_sem_s9897305228342|pcrid|43560483169|pmt|b|plc||pdv|c Shellshock]''' vulnerability.

= Shellshock Detection =

The following commands indicate the '''bash''' version running on a '''NST''' 20 based system which has the ''Shellshock'' vulnerability:

[user@nst ~]$ bash --version
GNU bash, version 4.2.47(1)-release (x86_64-redhat-linux-gnu)
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
[user@nst ~]$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'
vulnerable
hello
[user@nst ~]$

The output above shows that the ''echo vulnerable'' command was run by the '''env''' command (it should not have been). This is the indicator that the version of '''bash''' installed on this system has the ''Shellshock'' vulnerability.

= Shellshock Removal =

To remove the ''Shellshock'' vulnerability, you will need to update the version of the '''bash''' shell installed on your system. For a NST 20 based distribution (or any Fedora 20 based distribution), you can run the following command:

[user@nst ~]$ sudo yum update
[user@nst ~]$ sudo yum update
[sudo] password for user:
Loaded plugins: fastestmirror, filter-data, keys, langpacks, list-data

... lot's of output from yum ...

Total download size: 552 M
Is this ok [y/d/N]: y

... a lot more output from yum ...

Complete!
[user@nst ~]$

Once the '''bash''' package has been updated, you should see the following when testing for the ''Shellshock'' vulnerability:

[user@nst ~]$ bash --version
GNU bash, version 4.2.48(1)-release (x86_64-redhat-linux-gnu)
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
[user@nst ~]$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'
hello
[user@nst ~]$

The lack of the "''vulnerable''" output indicates that the updated version of '''bash''' has been patched and is no longer contains the ''Shellshock'' vulnerability.

NST Shellshock Detection - Revision history

Rwh at 12:53, 30 September 2014

Rwh at 12:51, 30 September 2014

Rwh at 12:51, 30 September 2014

Paul Blankenbaker at 12:27, 29 September 2014

Paul Blankenbaker: Created page with "__TOC__ This page shows how to test whether the version of bash installed on your '''NST''' system has the '''[http://www.symantec.com/connect/blogs/shellshock-all-you-need-k..."

Paul Blankenbaker: Created page with "TOC This page shows how to test whether the version of bash installed on your '''NST''' system has the '''[http://www.symantec.com/connect/blogs/shellshock-all-you-need-k..."