Urgent proliferation: Linux system bash serious security vulnerability CVE

Today, the weight network reminded me in the group, said that Linux has a serious bash vulnerability, has been busy and did not pay much attention, at night I looked down and found that Very serious, must be quickly spread out to prevent the server from being hacked into the group, causing serious consequences!

紧急扩散:Linux系统bash严重安全漏洞CVE-2014-6271的检测及修复方法

9月25日, after the "heart bleeding" vulnerability, security research experts have discovered a vulnerability with a catastrophic level, open source software company Red Hat said in a report. Bash software vulnerabilities widely used in Linux systems have the potential to allow hackers to exploit everything that is connected to the Internet.

The vulnerability number is CVE-2014-6271, mainly in bash 1.14 - 4.3. The affected Linux systems include: Red Hat Enterprise Linux (versions 4 ~ 7), Fedora distribution, CentOS (versions 5 ~ 7), Ubuntu 10.04 LTS, 12.04 LTS and 14.04 LTS, Debian, etc.

affected software and systems: GNU Bash <= 4.3

GNU Bash 4.3 and earlier have security vulnerabilities when dealing with certain constructed environment variables. Adding extra strings to function definitions within environment variable values ​​triggers This vulnerability could be exploited by an attacker to alter or bypass environmental restrictions in order to execute shell commands. Vulnerabilities can be executed remotely directly in the Web CGI environment supported by Bash! Some routers, bastion machines, VPNs and other network devices may also be affected. When a cgi program needs to create a child process and the environment variables are controllable, the attacker can construct a malicious attack code for remote attack through the http attributes such as useragent and querystring. It may directly cause the server to be maliciously controlled, resulting in the risk of data leakage.

The US Department of Homeland Security's US Computer Emergency Response Team ("US-CERT") warned that the vulnerability could affect Unix-based operating systems, including Linux and Mac OS X.

Vulnerability details page:http://seclists.org/oss-sec/2014/q3/650

Vulnerability level:Very serious

RedHat Official vulnerability details:

A flaw was found in the way Bash evaluated certain specially crafted environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue.

RedHat Officially provided detection method:

Login terminal, run the following command:

Shell
1
envx='() { :;}; echo vulnerable'bash-c"echo this is a test"

If you return the following content: Indicates that there is a secondary vulnerability, please upgrade as soon as possible.

Shell
1
2
vulnerable
thisisatest

紧急扩散:Linux系统bash严重安全漏洞CVE-2014-6271的检测及修复方法

Currently the official has provided the upgrade package, please execute the following command to upgrade:

Shell
1
yum update-ybash

紧急扩散:Linux系统bash严重安全漏洞CVE-2014-6271的检测及修复方法

After the upgrade, execute the previous command again to detect. If the following information appears, it means that it has been repaired:

紧急扩散:Linux系统bash严重安全漏洞CVE-2014-6271的检测及修复方法

Ubuntu users can upgrade bash by the following command:

Shell
1
apt-get update apt-getinstall bash

Other Linux distributions, if there is no online installation function, please use the following script to compile and install the bash vulnerability patch:

Shell
1
2
3
4
5
6
7
8
#!/bin/bash
cd/usr/local/src
wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz
tar zxf bash-4.3.tar.gz;cdbash-4.3
wget-r-nd-np http://ftp.gnu.org/gnu/bash/bash-4.3-patches/
forBP in`lsbash43-*|grep-vsig`;dopatch-p0<$BP;done
./configure
make&&makeinstall

The vulnerability detection method is the same as the previous one. In addition, some people mentioned whether it is necessary to restart the server after the upgrade? In fact, it is not needed, as long as it passes the vulnerability detection. Of course, you don't have to worry, it's okay to restart. . .

This vulnerability is very serious, please see the friends of this news spread to each other, beware of any loss caused by this vulnerability.

最新补: The latest vulnerability information and repair detection methods have been updated, please move ==>