Welcome to DU!
The truly grassroots left-of-center political community where regular people, not algorithms, drive the discussions and set the standards.
Join the community:
Create a free account
Support DU (and get rid of ads!):
Become a Star Member
Latest Breaking News
Editorials & Other Articles
General Discussion
The DU Lounge
All Forums
Issue Forums
Culture Forums
Alliance Forums
Region Forums
Support Forums
Help & Search
Remote exploit vulnerability in bash CVE-2014-6271
A remotely exploitable vulnerability has been discovered by Stephane Chazelas in bash on Linux and it is unpleasant. The vulnerability has the CVE identifier CVE-2014-6271 and has been given the name Shellshock by some. This affects Debian as well as other Linux distributions. You will need to patch ASAP.
Bash supports exporting shell variables as well as shell functions to other bash instances. This is accomplished through the process environment to a child process.
The major attack vectors that have been identified in this case are HTTP requests and CGI scripts.
Bash supports exporting shell variables as well as shell functions to other bash instances. This is accomplished through the process environment to a child process.
The major attack vectors that have been identified in this case are HTTP requests and CGI scripts.
TL;DR: an environment variable whose value's first three characters are "
){" processes as a function definition and will continue to execute any commands after the end of that function definition, eg FOO=" ){ls}; rm -rf /home" will define the function FOO and then remove the /home tree.
Ouch.
2 replies
= new reply since forum marked as read
= new reply since forum marked as read
