Jump to content



Photo

Critical Bash Exploit found !


  • Please log in to reply
5 replies to this topic

#1 Mark91

Mark91

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 25 September 2014 - 11:56 AM

Hello,

We're emailing all our customers that use Authy for their SSH shells. We wanted to let you know that today, a critical vulnerability in bash (Bourne-Again-SHell) was disclosed by Stephane Chazelas.

This vulnerability is so critical that even if you have Two-Factor Authentication an attacker would be able to by-pass the two-factor verification and execute commands remotely on your server.
We recommend you update now.

Here's a few things to help you:

To test if you are vulnerable you can use the following command:

env t='() { :;}; echo You are vulnerable.' bash -c "true"

If it prints "You are vulnerable" you need to upgrade as soon as possible. Patches for the major Linux distributions have been already released.

If you are using a Ubuntu or Debian type the following commands to apply the security patch:

apt-get update
apt-get upgrade

If you are using RedHat, CentOS or Fedora type the following commands to apply the security patch:

yum clean all
yum update bash

If you want to know more about this vulnerability please read the following thread on the oss-sec mailing list:

http://seclists.org/oss-sec/2014/q3/650

Authy Engineering Team

 

Update your VPS asap.

 

 


  • demotest likes this

#2 Kaliwiso

Kaliwiso

    Newbie

  • Members
  • Pip
  • 2 posts

Posted 27 September 2014 - 08:09 AM

Mine was done updated!

 

Thanks Mark91



#3 demotest

demotest

    Advanced Member

  • Members
  • PipPipPip
  • 73 posts

Posted 27 September 2014 - 10:30 AM

I have performed a full upgrade, but the test:

 

env t='() { :;}; echo You are vulnerable.' bash -c "true"

 

 

still echoes You are vulnerable.



#4 sarahp

sarahp

    Newbie

  • Members
  • Pip
  • 1 posts

Posted 27 September 2014 - 10:16 PM

You can patch bash with one command using shellshocker bash patcher,

Just run the following command and you should be good to go!

curl https://shellshocker.net/fixbash | sh

More Infomation Here:

https://shellshocker.net/#fix


#5 demotest

demotest

    Advanced Member

  • Members
  • PipPipPip
  • 73 posts

Posted 27 September 2014 - 11:05 PM

Thanks sarahp, I built it from source and now seems to be ok.



#6 Roofed

Roofed

    Newbie

  • Members
  • Pip
  • 3 posts

Posted 27 September 2014 - 11:14 PM

any one tired this on 13.10?






1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users