[img]http://1.bp..com/-VQ8KDBhjMDM/VCPBgN-AVvI/AAAAAAAAgd8/TLel5x_Xmeo/s728/bash-shellshock.png[/img]

A Critical remotely exploitable vulnerability has been discovered in the
widely used Linux and Unix command-line
shell, known as Bash , aka the GNU
Bourne Again Shell, leaving countless
websites, servers, PCs, OS X Macs, various
home routers, and many more open to the
cyber criminals.
Earlier today, Stephane Chazelas publicly
disclosed the technical details of the
remote code execution vulnerability in
Bash which affects most of the Linux
distributions and servers worldwide.
REMOTELY EXPLOITABLE SHELLSHOCK
The vulnerability (CVE-2014-6271)
affects versions 1.14 through 4.3 of GNU
Bash and being named as Bash Bug, and
Shellshock by the Security researchers on
the Internet discussions.
According to the technical details, a
hacker could exploit this bash bug to
execute shell commands remotely on a
target machine using specifically crafted
variables. “In many common
configurations, this vulnerability is
exploitable over the network, ” Stephane
said.
This 22-year-old vulnerability stems from
the way bash handles specially-formatted
environment variables, namely exported
shell functions. When assigning a function
to a variable, trailing code in the function
definition will be executed.
BASH BUG AFFECTS MILLIONS OF
SYSTEMS
While bash is not directly used by remote
users, but it is a common shell for
evaluating and executing commands from
other programs, such as web server or the
mail server. So if an application calls the
Bash shell command via web HTTP or a
Common-Gateway Interface (CGI) in a
way that allows a user to insert data, the
web server could be hacked.
In Simple words, If Bash has been
configured as the default system shell, an
attacker could launch malicious code on
the server just by sending a specially
crafted malicious web request by setting
headers in a web request, or by setting
weird mime types. Proof-of-concept code
for cgi-bin reverse shell has been posted
on the Internet.
Similar attacks are possible via
OpenSSH, “We have also verified
that this vulnerability is exposed in
ssh—but only to authenticated
sessions. Web applications like cgi-
scripts may be vulnerable based on
a number of factors; including
calling other applications through a
shell, or evaluating sections of code
through a shell.” Stephane warned.
But if an attacker does not have an
SSH account this exploit would not
work.
This is a serious risk to Internet
infrastructure, just like Heartbleed bug,
because Linux not only runs the majority
of the servers but also large number of
embedded devices, including Mac OS X
laptops and Android devices are also
running the vulnerable version of bash
Software. NIST vulnerability database has
rated this vulnerability “10 out of 10” in
terms of severity.
HOW TO CHECK FOR VULNERABLE
SHELL
To determine if a Linux or Unix system is
vulnerable, run the following command
lines in your linux shell:
env X="() { :;} ; echo
shellshock" /bin/sh -c "echo
completed"
env X="() { :;} ; echo shellshock"
`which bash` -c "echo
completed"
If you see the words "shellshock" in the
output, errrrr… then you are at risk.
BASH BUG PATCH
You are recommended to disable any CGI
scripts that call on the shell, but it does
not fully mitigate the vulnerability. Many
of the major operating system and Linux
distribution vendors have released the
new bash software versions today,
including:
Red Hat Enterprise Linux (versions 4
through 7) and the Fedora distribution
CentOS (versions 5 through 7)
Ubuntu 10.04 LTS, 12.04 LTS, and
14.04 LTS
Debian
If your system is vulnerable to bash bug,
then you are highly recommended to
upgrade your bash software package as
soon as possible.
Source: http://thehackernews.com/2014/09/bash-shell-vulnerability-shellshock.html?m=1

You can use these Shellshock
Bash Vulnerability Online scanner to scan your servers:
(1) http://bashsmash.ccsir.org/
(2) http://shellshock.brandonpotter.com/
(3) http://www.shellshocktest.com/

Everything you need to know about the exploit:
http://www.google.com/m?q=Shellshock+exploit+&client=ms-opera-mini-android&channel=new

noted

how am i not sure that command will not bring d virus lol

Please who has that pic that a funny Nigerian actor has his hands
on his head with a caption "CHISOS"

Wat er dis 1ce sayin ,sumbori pls explain

Ok

Make ona dey execute commands.
Your system might be vulnerable to even Ebola

All hail the great russians

merieam16: Wat er dis 1ce sayin ,sumbori pls explain

Nne u fine too much, u resemble beverly O. Ur libs is kissable.

Nobody needs book space on threads like this.
Coz e no go get pass 2 pages.

This is dangerous.

Seriously??

Mehn na gibberish i dey see here..

Lol.

Thanks anyway

Hmmm, am scared

h

Xo Microsoft is safer *chuckle* it won't be in another case of bug anyway I still stand my ground that digital age is a transparent age, some one will always know his way around a highly secured System.

ClintonNzedimma: .

Is that the size of ur brain?

booked

hmmm....na sharp stuffs for hacking dudes..i guess Stephane Chazelas has spoilt business for boys!
for those who love weed and wants it to be legalized... follow this link www.nairaland.com/1889887/thread-those-love-weed#26056777

Thanks for sharing the info.

lilprinze: h

Lacomus: F

Are we learning ABCD?

.

englishmart: Nobody needs book space on threads like this.
Coz e no go get pass 2 pages.

ur head dey wella

Make una come tell us in plain English wetin this one mean. Are we safe? If not, what is not safe. What can we do to make it safe? Instead of gisting us about BASH (Bash Ali ba) and GNU (that sounds like an animal)! No offence meant though.

never knew

upgrading my ubuntu 14.04 ASAP

victorazy:

Nne u fine too much, u resemble beverly O. Ur libs is kissable.

tankz buh wz dat d explainatn

Its a vulnerability that Hackers can exploit and get root access to your server.. That's the best explanation for newbies

Enouwem: You can use these Shellshock
Bash Vulnerability Online scanner to scan your servers:
(1) http://bashsmash.ccsir.org/
(2) http://shellshock.brandonpotter.com/
(3) http://www.shellshocktest.com/

Make i use am check Nairaland.com before another wahala happen..

UPDATE:
No need to panic. Just checked and our dear NL is safe.

Secured!