Bash code injection vulnerability

Software

This is serious. Potentially worse than Heartbleed. CVE-2014-6271:

A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue.

Red Hat has a command you can use to test if you’re vulnerable, along with some nice details.

Update bash on your boxes, or if you can’t, shut down SSH and block it with your firewall rules.

On FreeBSD, uninstall it and make tcsh your friend again.

Author bio and support

Me!

Ruben Schade is a technical writer and IaaS engineer in Sydney, Australia who refers to himself in the third person in bios. Wait, not BIOS… my brain should be EFI by now.

The site is powered by Hugo, FreeBSD, and OpenZFS on OrionVM, everyone’s favourite cloud infrastructure provider.

If you found this post helpful or entertaining, you can shout me a coffee or buy some silly merch. Thanks!