Translate
|
http://www.berklix.com/~jhs/bash/By Julian H. Stacey - Other Blogs & TextsFriday 26 September
2014 - Best avoid web forms for some days ! Another Security Alert: ShellShock (BASH). Why ShellShock (BASH) may affect you:
References
Apache Sample Scripts
A look at apache server sample scripts, to see how much they
set precedent using Bash:
cd /usr/ports/www/apache22/work/httpd-2.2.25 find . -type f | xargs grep -i -l bash | sort vi -c/bash `find . -type f | xargs grep -i -l bash | sort` ./CHANGES ./README.platforms ./build/rpm/htcacheclean.init ./build/rpm/httpd.init ./configure ./configure.bak ./modules/proxy/proxy_util.c # Just Comments ./srclib/apr-util/configure ./srclib/apr-util/test/nw_misc.c ./srclib/apr-util/xml/expat/README ./srclib/apr-util/xml/expat/configure ./srclib/apr-util/xml/expat/conftools/libtool.m4 # Just Comments ./srclib/apr/build/libtool.m4 # Just Comments ./srclib/apr/configure ./srclib/apr/include/apr_file_info.h # Just Comments ./srclib/apr/test/nw_misc.c ./srclib/pcre/configure A Test
For more & newer tests & consideration of other
shells, eg ksh etc, see the security@freebsd mail list link above.
csh
# Next line from np@, Thanks.
env x='() { :;}; echo Vulnerable.' bash -c "echo This is a test."
# Old bash:
Vulnerable.
# Fresh patched current bash:
This is a test.
bash: warning: x: ignoring function definition
attempt
bash: error importing function definition for `x' This is a test. # Show the error message goes to stderr, not stdout: env x='() { :;}; echo Vulnerable.' bash -c "echo This is a test." > stdout
# Old bash:
Nothing to stderr
# Fresh patched current bash:
To stderr:
cat stdout
bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x'
# Old bash:
Vulnerable.
This is a test. # Fresh patched current bash:
This is a test.
|
