HTTP ShellShock Exploit

ALTERNATIVE NAMES

Bashdoor

AFFECTED SYSTEMS

All UNIX based systems with Bash version 2.05b or lower.

POC

To check if your server is vulnerable to ShellShock, enter the code below in your terminal. If you get a “vulnerable to ShellShock” message, your server is vulnerable to the ShellShock Exploit.

env x='() { :;}; echo vulnerable to ShellShock' bash -c :

SOLUTION

Luckily the solution is very simple. Just update bash to latest available.

#CentOS
yum upgrade bash
#Debian
apt-get update && apt-get install --only-upgrade bash

LEGAL

Permission is granted for the redistribution of this alert by explicitly linking the page to be referred. It may not be edited in any way without written consent.

Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties concerning this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from the use of, or reliance on, this information.