Secure your Linux , apple pc, servers
Try the vulnerability test (in Terminal):
$ env x='() { :;}; echo vulnerable' bash -c 'echo hello'
if you are vulnerable, you get back:
vulnerable
hello
if get it "vulnerable" please immediate update bash shell at linux.
for Centos\RHEL linux :
yum update bash
For ubuntu :
apt-get update
aptapt-get install --only-upgrade bash
or
mkdir src
cd src
wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz
#download all patches
for i in $(seq -f "%03g" 0 25); do wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done
tar zxvf bash-4.3.tar.gz
cd bash
cd bash-4.3
#apply all patches
for i in $(seq -f "%03g" 0 25);do patch -p0 < ../bash43-$i; done
#build and install
./configure && make && make install
cd
cd ..
cd
cd ..
rm -r src
export VULNCHECK='() { :; }; echo You are still vulnerable'; bash
“You are still vulnerable”
You can see if you’re vulnerable by running the following command:
In a vulnerable environment, it’ll say:
And again check vulnerability if look like its fine.
or
$ env X="() { :;} ; echo busted" /bin/sh -c "echo hello"
hello
or
otherwise you get:
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
hello
No comments:
Post a Comment