The “bash” Vulnerability
This special newsletter is to update you about the recently disclosed “Shellshock” vulnerability and how to respond to this vulnerability to protect your information assets.
What is Shellshock and how it will impact you?
GNU Bourne Again Shell (Bash), through 4.3 bash43-025, is a command-line utility on multiple Linux and Unix operating systems has inherent weakness that could allow a remote attacker to exploit servers. Bash shell is used in Unix systems allows code execution via environment variables. Attacker has to be able to trick the user into opening bash after setting specifically crafted variables.
The vulnerability can be exploited through the vectors such as CGI, SSH or DHCP. Servers on the internet with CGI scripts are exploited by converting the HTTP headers into environment variables, SSH can be used to escape restricted ssh shells and the DHCP can be exploited by DHCP clients by executing malicious code. These exploits are easy to perform, and a number of Proof-of-Concept code is floating on the internet. The attacker will be able to execute any shell command.
How to Detect & Protect your Systems and Data?
Vulnerability scanners have already included the Shellshock patterns, and a scan would reveal if the servers were vulnerable. Alternatively, you could run the following strings while logged into the system
env x='() { :;}; echo vulnerable’ sh -c “echo this is a test”
env -i X='() { (a)=>\’ bash -c ‘echo date’; cat echo
