Shellshock Bash Vulnerability

Posted on Sunday March 13, 2016 / by Eric Potvin

The vulnerability allows remote attackers to execute arbitrary code given certain conditions, by passing strings of code following environment variable assignments. Because of Bash's ubiquitous status amongst Linux, BSD, and Mac OS X distributions, many computers are vulnerable to Shellshock; all unpatched Bash versions between 1.14 through 4.3 (i.e. all releases until now) are at risk.

Check System Vulnerability

env VAR='() { :;}; echo Bash is vulnerable!' bash -c "echo Bash Test"

If you see this code, it means you are vulnerable

Bash is vulnerable!
Bash Test

The fix

sudo apt-get update && sudo apt-get install --only-upgrade bash

If you run the command again, you will see:

bash: warning: VAR: ignoring function definition attempt
bash: error importing function definition for `VAR'
Bash Test