Shellshock, Aftershock & P2PoolIf you have not heard, a new vulnerability called Shellshock — also called the "Bash Bug" — is affecting both Linux computers and Macs, and it has the potential to let attackers take control of your computer or server.
Many P2Pool nodes run on Linux and Mac, to test your node open up a shell and run:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
If you see:
vulnerable
this is a test
You are vulnerable and should update bash immediately.
Linux users should run:
sudo apt-get update
sudo apt-get install bash
Apple has promised a security fix for Mac users soon.
Thanks for the heads up windpath! Once you've installed the patched shell this is what you'll see:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
That's on Ubuntu 14.04LTS fully updated as of the time of writing this post. OSX 10.9.5 Mavericks is still vulnerable:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
I have 3 servers, 2 only says "This is a test" with no warnings...is that also normal?
The 3rd one says "vulnerable" and "this is a test". I've done an apt-get update/upgrade, and it claims its the newest version. Any idea why that wouldn't have worked on there? That one is Debian 6.0.10
Hunter, I'm not 100% on this, but you may have fixed Shellshock, but still be vulnerable to Aftershock...
(note the aftershock fix was integrated before I first posted this)
The bash fix for CVE-2014-6271 (Shellshock) was incomplete and command injection is possible even after the patch has been applied. The issue is being tracked as CVE-2014-7169 (Aftershock).
Ongoing discussion here:
https://news.ycombinator.com/item?id=8361574If fixed after running
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
you should see
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
if still vulnerable you should see
vulnerable
this is a test
Aftershock has its own test:
env var='() {(a)=>\' bash -c "echo date"; cat echo; rm -f echo
If fixed you will see:
bash: var: line 1: syntax error near unexpected token `='
bash: var: line 1: `'
bash: error importing function definition for `var'
date
cat: echo: No such file or directory
If vulnerable you will see:
bash: var: line 1: syntax error near unexpected token `='
bash: var: line 1: `'
bash: error importing function definition for `var'
Fri Sep 26 09:20:00 UTC 2014
Hope this helps...
