Thursday, September 25, 2014

Critical BASH vulnerability - updating BASH and testing

A recent bug report has revealed a security vulnerability in BASH.  This vulnerability allows for remote execution, however, it has been resolved in the latest version of bash: 4.1.2-15.el6_5.1

For further information on the bug, see here.

You can test if your version of BASH is vulnerable by running the following command:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"






If it prints out 'vulnerable', well guess what, your system is vulnerable.
Luckily for you, this vulnerability is easy to deal with. 

Simply update to the latest version of BASH:

sudo yum clean all
sudo yum update bash

A reboot is not required once you've downloaded and installed the update.

To double check that you are no longer vulnerable, you can run the test again and you can check which version of BASH is installed by running the following command:

rpm -qa | grep bash

If your version of BASH is earlier than bash-4.1.2-15.el6_5.1 you may be vulnerable.
I recommend you subscribe to user-groups, tech blogs, and customer groups to ensure you hear about the latest bugs\vulnerabilities you should worry about.


No comments:

Post a Comment