env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
From https://securityblog.redhat.com/2014/09/24/bash-specially-cr...
From https://securityblog.redhat.com/2014/09/24/bash-specially-cr...
curl -H 'User-Agent: () { :;}; echo; echo vulnerable to CVE-2014-6271' <shell script CGI URL>
Tested and working against a shell script CGI.
Arch was fast.
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
apt-get update
apt-get install bash
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
Edited: Seems like jvreeland has a clearer picture: https://news.ycombinator.com/item?id=8362309
ii bash 4.3-9 i386 GNU Bourne Again SHell
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable this is a test
From the FAQ:
> Does sid have security updates?
Not in the same sense that stable does. If the maintainer of a package fixes a security bug and uploads the package, it'll go into sid by the normal means. If the maintainer doesn't do that, then it won't. The security team only covers stable (and possibly testing... there's a pending issue for that case).
Edit: I see that even those who got the patch are in fact still vulnerable.
squeeze. jessie and wheezy are still vulnerable.
It's been uploaded to squeeze-lts but has not reached the mirrors.
You can get it manually from http://incoming.debian.org/debian-buildd/pool/main/b/bash/ if you can't wait.
deb http://http.debian.net/debian/ squeeze-lts main contrib non-free
deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free APT::Default-Release "squeeze";
If you have that line remove it or change it to squeeze-lts
$ x='() { :;}; echo vulnerable' bash -c 'echo test'
vulnerable
test
$ pacman -Syu
...
$ x='() { :;}; echo vulnerable' bash -c 'echo test'
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
test
Still vulnerable.
env X='() { (lol)=>\' bash -c "echo id"; cat echo