Be Excellent To Each Other

So there's a big old vulnerability in Bash, and it's been there 22 years.

If you run a server that has Bash on, fire it up and try this command:

It will echo the word "stuff". If it also echos the word "busted", then you've just successfully exploited Bash, and you need to update it.

More info once I'm finished doing my servers

viewtopic.php?p=835895#p835895

:-)

My cpanel server patched itself overnight, and I did the ones at work this morning. I do so love a good new ancient bug revelation.

The news stories are on about how this will allow people to hack your system via a light bulb and other stuff - its amusing at times

(the new series of NCIS started this week and they had a virus that used the power cable of a laptop to escape a Faraday cage and then infect their whole system)

Have you checked it? There's some talk about early patches not working.

The initial patch appears to patch the exploit, not the bug. If that makes sense.

Uh ohs, one of my servers is vulnerable.

None of our servers are vulnerable. Woo to the yay.

I don't have a server. I win!

Do you have anything running OS/X?

Aye I've checked and it appears fine. The news is the RHEL patch doesn't cover every possible vector so they're working on it. Another update will be coming very shortly I imagine.

What's it actually doing? My bash-fu is weak

I read this earlier so I'm recalling from poor memory, but basically it allows for injection of code after a function definition which can be stated arbitrarily. Something like that.

I expect Gaywood will pop along with a breakdown shortly.