Severe shell vulnerability detected in Unix

Other Forums Beer Garden
,
1

I just got a security flash from CERT-SE that informed me that there have been a severe security issue detected in unix shell.
The vulnerability lets a potential attacker execute malicious code in the shell, and gain access to the system.

At present there are no known workarounds for this issue, except running a WAF. To test if your system is afflicted by this issue, you can run the following command in the commandline:


$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

If your system is afflicted, you will see the following output in your shell:


vulnerable
this is a test

At present this vulnerability is known to be exploited by atleast one worm.

For more information, see the following articles:

2

Hi Evanion

Many thanks, your correct and one of our systems failed, but has now been patched thanks, but all other systems had already been updated.

For those on centos, ssh in and run yum update, where you’ll see bash update ready to install

I hope your keeping well

Many thanks

John

3

Yes, thanks for bringing attention to this. If you have auto OS updates enabled on your InterWorx box, the update should have been applied. Otherwise, definitely run yum update to secure your system.

4

Actually, looks like the issue isn’t fully patched yet:

https://access.redhat.com/articles/1200223

In any case, keeping OS Updates enabled on your InterWorx boxes is highly recommended and will ensure your box receives the updated patch when it’s released by red hat.

To check your update settings, log into NodeWorx and go to Server >> Software Updates.

5

[QUOTE=IWorx-Brett;26276]Actually, looks like the issue isn’t fully patched yet:

https://access.redhat.com/articles/1200223

In any case, keeping OS Updates enabled on your InterWorx boxes is highly recommended and will ensure your box receives the updated patch when it’s released by red hat.

To check your update settings, log into NodeWorx and go to Server >> Software Updates.[/QUOTE]

And Houston we have a problem: http://us3.campaign-archive2.com/?u=722bc323a024d15a407baae81&id=af55e39aa1&e=32ff2cc196

“We have both been made aware of some malware being spread via this vulnerability and we have seen another variant our self on our own IDS.”

6

Hi

I wonder if this is also connected with the bots trying to take over routers, computers, IoT (internet of Things) etc… for mass bot DDoS.

It’s just a thought

Many thanks

John