On September 24th 2014, a vulnerability was reported in the GNU Bourne-Again-Shell (BASh, or Bash), specifically a flaw with how Bash processes values of environment variables, that allows remote code execution of varying types in many common configurations. The overall risk is severe due to bash being configured for use, by default, on most Linux servers.
Although we immediately began working to proactively patch this vulnerability, some servers may remain vulnerable depending on their update settings or other unforeseen intervening factors.
In a nutshell, this flaw exploits Bash, a Unix command-line shell run by default on most Linux servers and allows for remote code execution, and many types of command-line based attacks.
No need to panic, a patch is available, and your server can be easily updated.
First check whether your server is vulnerable
To test if your version of Bash is vulnerable, run the following command:
[php]$ env x='() ; echo vulnerable’ bash -c “echo this is a test”[/php]
If the output of the above command looks as follows:
[php]vulnerable
this is a test[/php]
You are using a vulnerable version of Bash. The patch used to fix this issue ensures that no code is allowed after the end of a Bash function.
If you run the above example with the patched version of Bash, you should get an output verifying you are not vulnerable:
[php]$ env x='() ; echo vulnerable’ bash -c “echo this is a test”
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x’
this is a test[/php]
If you have a managed server with us, please contact technical team to get patch the vulnerability. Please do not do it yourself.
Updating Bash on Red Hat and CentOS
Pre-Flight Check
These instructions are intended specifically for updating Bash on Red Hat and CentOS.
Clean-Up Yum
[php]yum clean all[/php]
Update Bash
Updating Bash is as simple as running just one command:
[php]yum -y update bash[/php]
Updating Bash on Debian and Ubuntu
Pre-Flight Check
These instructions are intended specifically for updating Bash on Debian and Ubuntu.
Clean-Up Apt-get
[php]apt-get autoclean[/php]
Update Bash:
Updating Bash is as simple as running just one command:
[php]apt-get install –only-upgrade bash[/php]
Updating Bash on CentOS 6 and CentOS 7
Pre-Flight Check
These instructions are intended specifically for updating Bash on CentOS 6 and CentOS 7.
Clean-Up Yum
[php]yum clean all[/php]
Update Bash
Updating Bash is as simple as running just one command:
[php]yum -y update bash[/php]
