New bug in Linux Bash exploited (Shellshock Bug)

[universal4]

On Wednesday CERT (US Computer Emergency Readiness Team) released an alert about a bug discovered in the Linux tool Bash.

As of Thursday, multiple attacks were already taking advantage of that vulnerability, a long-standing but undiscovered bug in the Linux and Mac tool Bash that makes it possible for hackers to trick Web servers into running any commands that follow a carefully crafted series of characters in an HTTP request.

From what I have read so far this looks like it could spread rapidly.

If you run your own servers you may want to look into this.

Red Hat originally had a patch but that can be circumvented.
[quoter]But Kaspersky’s Schouwenberg recommended that server administrators still implement the existing patch; While it’s not a complete cure for the shellshock problem, he says it does block the exploits he’s seen so far. [/quote]
More on this can be found here: http://www.wired.com/2014/09/hackers...-ddos-attacks/

Hopefully most manufactures and the community as a whole will get working patches out quickly.

I have not yet had much time to do a lot of research into this, so if anyone has and can shed some light please do so.


Rick
Universal4

[universal4]

I found this at Serverfault and it gives a clear cut explanation of how to tell if your system is vulnerable.

http://serverfault.com/questions/631...shellshock-bug


Rick
Universal4

[universal4]

I read up a little more on this last night, changing the shell is a temporary fix also, but only do so if you are sure bash is not needed temporarily.

Here is a wiki on it
http://en.wikipedia.org/wiki/Shellsh...oftware_bug%29

At the bottom of the wiki are links to some of the most common Linux installs and many provide detailed patch instructions.

Rick
Universal4

Side note: I am starting to wonder if I should move this thread to Industry Buzz or not since it might be important enough of an issue to some members that run their own boxes....