How to Protect Your Server Against the Shellshock Bash Vulnerability

Ubuntu now has the latest version of Bash sent out to their repositories. More info here:

http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-7169.html

Thanks for this. Fixed it on my home computer and remote server. Awesome!

After update, is there any need to restart anything ??

I am with CentOS 6.5 x32

Hey Guys,

I just checked & updated the path on one of our production server.

After doing a “yum update bash”, rechecked:

env VAR=‘() { :;}; echo Bash is vulnerable!’ bash -c “echo Bash Test”

It simply gave below output:

Bash Test

Is this still vulnerable or patches updated? Please suggest.

Cheers, Vasu

Here’s Puppet code to patch it on CentOS:

exec { 'patch_shellshock_security_hole':
  command => "/usr/bin/yes | /usr/bin/yum update bash; touch /root/shellshock_bug_has_been_patched",
  creates => '/root/shellshock_bug_has_been_patched',
}

I have just tested this code and it worked fine on CentOS 6.4.

Ross

Same for Ubuntu 13.10?

i have 4.5.1(1) on 2 Ubuntu Servers. Does that mean not vulnerable? Test says otherwise. You state 4.3 is the latest.

I think, even if it’s not vulnerable, it’s a good idea to update bash to lastest version

I have Ubuntu 12.10 that is not more supported… what the best way to upgrade?

I hadn’t touched my droplet in quite a while - turns out I’m on 12.04 which has been EOL’ed and can’t seem to be updated. Any suggestions on how to handle this?

The CentOS yum repository has the fix. I just installed it on my CentOS 6.5 droplets.

Not so fast! Give it a try, still vulnerable!

env -i X=' () { }; echo hello' bash -c 'date'

https://shellshocker.net/

Thank you Digital Ocean, I am very happy with your hosting company :)

if you have some old / EOL release, this code may help you.

it requires you to have a compiler, patch & make, as such you may need to install these packages

for Ubuntu you can do

for CentOS/variants

(you may uninstall them afterwards if you no longer need)

after that, you can install bash from scratch, follow these commands (taken from the internet somewhere)

can first “cd /tmp” or start in any directory of your choice; must be executed as root [updated 2014-09-27 0900 EST [GMT-0500] now 26 patches instead of 25] [updated 2014-09-28 0900 EST [GMT-0500] now 27] [updated 2014-10-01 1400 EST [GMT-0500] now 28] [updated 2014-10-02 2300 EST [GMT-0500] now 29]

mkdir src
cd src
wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz
#download all patches
for i in $(seq -f "%03g" 0 30); do wget     http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done
tar zxvf bash-4.3.tar.gz 
cd bash-4.3
#apply all patches
for i in $(seq -f "%03g" 0 30);do patch -p0 < ../bash43-$i; done
#build and install
./configure && make && make install
cd .. 
cd ..
rm -r src

after this you should have the newest bash installed on your system

run the test again to check yourself

env VAR='() { :;}; echo Bash is vulnerable!' bash -c "echo Bash Test"

you should be good to go now!

To update from an older version of ubuntu (e.g. saucy), run this first:

sudo sed -i 's/saucy/trusty/g' /etc/apt/sources.list

That will update your sources to the newer ones. It might cause some incompatibility eventually, but it let me fix this problem for now.

I did the update and now can no longer SSH into my droplet. Anyone have any thoughts?

For people using ServerPilot to manage servers running PHP and WordPress sites, your servers are already patched. More info here:

https://www.serverpilot.io/blog/2014/09/25/bash-shellshock-security-updates.html

Ubuntu here… 4 droplets. Worked for versions 12.04 and 14.04 but not working in version 13.10

after running the apt-get command

… bash is already the newest version. 0 upgraded, 0 newly installed, 0 to remove and 84 not upgraded.

but vulnerability still there based in the test for version 13.10 as i said.

Thanks for making it easy. Just two commands, one to see that I need a fix and one to fix it. All done! I’m no linux guru, I just want to run a wordpress server!

I have some droplets with:

Distributor ID: Ubuntu Description: Ubuntu 12.10 Release: 12.10 Codename: quantal

And they don’t update. What i need to do so?

i mean, threre wont be a patch for this (others) version?

For older versions of Ubuntu you can follow the steps here:

http://cloudgames.com/blog/fix-bash-exploit-old-new-releases-ubuntu-apt-get/

You can update the respository to get the latest bash version and then can always set the repository back to the original after updating bash.

Here is what I did for my Ubuntu droplet…

apt-get update && apt-get -y upgrade apt-get install -y bash

seems to have worked

I do an apt-get update and even an apt-get upgrade on my Debian(6) squeeze and it says all packages are up to date so sudo apt-get update && sudo apt-get install --only-upgrade bash does not do anything. Bash is latest version and still not fixed, any other way i can update it?

Great article, well written and easy to follow. Thanks!

Thanks this really useful, i have fixed my bash!!!

If the test on http://shellshock.brandonpotter.com/ is showing no vulnerabilities, but the bash test command does show vulnerabilities, do you think we are safe to wait until the full fix is released?

Thank you,

Hello -

Is it really fixed? :

Still more vulnerabilities in bash? Shellshock becomes whack-a-mole http://arstechnica.com/security/2014/09/still-more-vulnerabilities-in-bash-shellshock-becomes-whack-a-mole/

From the above article I think it is not fixed.

cfg83

Hello -

On my 14.x Ubuntu droplet I am patched up to bash 4.3.11(1)-release

I went here :

https://twitter.com/taviso/status/514887394294652929

And tried this test :

env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "still vulnerable :("

And got this output :

bash: X: line 1: syntax error near unexpected token `='
bash: X: line 1: `'
bash: error importing function definition for `X'
echo vuln
still vulnerable :(

Question: Is the above test legitimate?

cfg83

Thanks a lot, just fixed it on my holaunblocker.com droplet.

Thanks. It worked out perfectly on Ubuntu 14.04 and 12.04.

Does anybody know how to upgrade bash on Debian lenny?

You must use the squeeze-lts repository in order to continue receiving updates to Debian 6 Squeeze

To add this repository, edit /etc/apt/sources.list and add the line

deb http://ftp.us.debian.org/debian squeeze-lts main non-free contrib

To update only bash, after running apt-get update use apt-get install --only-upgrade bash

You all should have been using Zsh instead of Bash in the first place.

We all ought to be using Zsh instead of Bash in the first place.

If you’re using gd’s solution below to build from scratch, change the two loop values from 25 to 26:

for i in $(seq -f “%03g” 0 26); do …

because there is one more patch available, dealing with the latest vulnerability.

Thanks a lot, but is there any opportunity to update my OS X Server?

BTW, here is good HOWTO to protect web applications agains ShellShock, not only servers.

Debian 7 works great!

env VAR=‘() { :;}; echo Bash is vulnerable!’ bash -c “echo Bash Test” Bash is vulnerable! Bash Test So… env VAR=‘() { :;}; echo Bash is vulnerable!’ bash -c “echo Bash Test” Bash Test

Fucking thank you!!!

Great article. Thanks for simplifying it.

Just wanted to say thank you. I am very happy to see that the documentation is growing!

Keep up the excellent work and thank you for your detailed article!

Worked flawlessly on our gitlab

My debian server now passes the above “Check System Vulnerability” test. But I read elsewhere of the test below, which fails: env var='() {(a)=>' bash -c “echo date”; cat echo

Apparently a patched system should not print the date, but my system does. Is this something that requires action in addition to the instructions above?

Excellent article. Now that we know that there is a fix for Shell Shock, I just want to share with everyone that if you want to check if your Mac or Linux is vulnerable to Shell Shock. You can find out more about checking Shell Shock vulnerability from this page:

http://devicegarage.weebly.com/diy-repair-blog/shell-shock-check

Centos 6.5 without updating getting only Bash Test, do i have to update the bash?

as a suggestion, people with old ubuntu releases should consider getting their boxes updated to a recent release.

You can use “do-release-upgrade” to do so. If it is not available, run “sudo apt-get install update-manager-core” after fixing your “etc/apt/sources.list”

Note that if you see the following IP’s in your logs it’s just scanning:

209.126.230.72 (Erratesec) 166.78.61.142 (Nixon Security) 54.217.253.19 (Detectify) (from the TIB at http://pwc.blogs.com/cyber_security_updates/2014/09/how-can-you-deal-with-shellshock.html )

I can’t see how this BASH bug allows a completely unauthorised user to compromise a system without access to at least an unprivileged account on the target machine.

Don’t get me wrong, all my systems are patched, even the ones hidden well behind firewalls - I’m not that silly/adventurous.

Just simply being that unless the attacker can gain more access to my system(s) than I care for I can’t see their opportunity to access bash enough to attempt to exploit the bug.

Please tell me how anyone who doesn’t have access to at least an unprivileged account on the target system can possibly exploit the bug - maybe it would not be wise to go into detail really, perhaps just a firm statement that it is possible will suffice me.

If it is possible for somebody with no (access to any) account on the target system to use this vulnerability then there must be some other window/door/entry-point that needs closing too imho.

Well, Why you didn’t cover or at least mention the other shell bugs that are more serious than this one? Please go to ShellShocker and you will get the latest update about shellshock.

Here are the current exploits (source:ShellShocker ):

Exploit 1 (CVE-2014-6271)

There are a few different ways to test if your system is vulnerable to shellshock. Try running the following command in a shell.

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

If you see “vulnerable” you need to update bash. Otherwise, you should be good to go.

Exploit 2 (CVE-2014-7169)

Even after upgrading bash you may still be vulnerable to this exploit. Try running the following code.

env X='() { (shellshocker.net)=>\' bash -c "echo date"; cat echo ; rm -f echo

If the above command outputs the current date (it may also show errors), you are still vulnerable.

Exploit 3 (???)

Here is another variation of the exploit. Please leave a comment below if you know the CVE of this exploit.

env -i X=' () { }; echo hello' bash -c 'date'

If the above command outputs “hello”, you are vulnerable.

Exploit 4 (CVE-2014-7186)

bash -c 'true <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF' ||
echo "CVE-2014-7186 vulnerable, redir_stack"

Exploit 5 (CVE-2014-7187)

(for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
echo "CVE-2014-7187 vulnerable, word_lineno"

Already updated :) Thx

Great post. you can also assess, prepare, defend and react to the shellshock epidemic by referring this Toolkit

Tried to upgrade an Ubutnu 12.10 Quantal installation using this guide and it looks like the DigitalOcean mirrors are preventing the apt-get package list from downloading, so there’s no upgrade available for bash. What can I do to resolve?

# Observe bash is vulnerable:
colin@menagerie1:~$ env 'VAR=() { :;}; echo Bash is vulnerable!' 'FUNCTION()=() { :;}; echo Bash is vulnerable!' bash -c "echo Bash Test"
Bash is vulnerable!
bash: FUNCTION(): line 0: syntax error near unexpected token `)'
bash: FUNCTION(): line 0: `FUNCTION() () { :;}; echo Bash is vulnerable!'
bash: error importing function definition for `FUNCTION'
Bash Test


# Check version:
colin@menagerie1:~$ bash --version
GNU bash, version 4.2.37(1)-release (x86_64-pc-linux-gnu)
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.


# Attempt upgrade:
colin@menagerie1:~$ sudo apt-get update && sudo apt-get install --only-upgrade bash
[sudo] password for colin: 
Ign http://security.ubuntu.com quantal-security Release.gpg
Ign http://mirrors.digitalocean.com quantal Release.gpg                
Ign http://mirrors.digitalocean.com quantal-updates Release.gpg        
Ign http://security.ubuntu.com quantal-security Release
Ign http://security.ubuntu.com quantal-security/main amd64 Packages/DiffIndex
Ign http://mirrors.digitalocean.com quantal Release
Ign http://mirrors.digitalocean.com quantal-updates Release
Ign http://mirrors.digitalocean.com quantal/main amd64 Packages/DiffIndex
Ign http://mirrors.digitalocean.com quantal/universe amd64 Packages/DiffIndex
Ign http://mirrors.digitalocean.com quantal-updates/main amd64 Packages/DiffIndex
Ign http://mirrors.digitalocean.com quantal-updates/universe amd64 Packages/DiffIndex
Ign http://security.ubuntu.com quantal-security/main Translation-en_US
Ign http://security.ubuntu.com quantal-security/main Translation-en
Err http://security.ubuntu.com quantal-security/main amd64 Packages
  404  Not Found [IP: 91.189.88.149 80]
Ign http://mirrors.digitalocean.com quantal/main Translation-en_US
Ign http://mirrors.digitalocean.com quantal/main Translation-en
Ign http://mirrors.digitalocean.com quantal/universe Translation-en_US
Ign http://mirrors.digitalocean.com quantal/universe Translation-en
Ign http://mirrors.digitalocean.com quantal-updates/main Translation-en_US
Ign http://mirrors.digitalocean.com quantal-updates/main Translation-en
Ign http://mirrors.digitalocean.com quantal-updates/universe Translation-en_US
Ign http://mirrors.digitalocean.com quantal-updates/universe Translation-en
Err http://mirrors.digitalocean.com quantal/main amd64 Packages
  404  Not Found
Err http://mirrors.digitalocean.com quantal/universe amd64 Packages
  404  Not Found
Err http://mirrors.digitalocean.com quantal-updates/main amd64 Packages
  404  Not Found
Err http://mirrors.digitalocean.com quantal-updates/universe amd64 Packages
  404  Not Found
W: Failed to fetch http://security.ubuntu.com/ubuntu/dists/quantal-security/main/binary-amd64/Packages  404  Not Found [IP: 91.189.88.149 80]

W: Failed to fetch http://mirrors.digitalocean.com/ubuntu/dists/quantal/main/binary-amd64/Packages  404  Not Found

W: Failed to fetch http://mirrors.digitalocean.com/ubuntu/dists/quantal/universe/binary-amd64/Packages  404  Not Found

W: Failed to fetch http://mirrors.digitalocean.com/ubuntu/dists/quantal-updates/main/binary-amd64/Packages  404  Not Found

W: Failed to fetch http://mirrors.digitalocean.com/ubuntu/dists/quantal-updates/universe/binary-amd64/Packages  404  Not Found

E: Some index files failed to download. They have been ignored, or old ones used instead.

As you can see, the apt-get update fails, so there’s no updated package list and thus the upgrade of bash doesn’t take place.

Any help?

Thanks a lot! My droplet was vulnerable, but no more thanks to your tutorial.