这是一个创建于 3704 天前的主题，其中的信息可能已经有所发展或是发生改变。
http://threatpost.com/major-bash-vulnerability-affects-linux-unix-mac-os-x
检测：
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
中招的显示:
vulnerable
this is a test
如果是没有问题，则是下面
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
检测：
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
中招的显示:
vulnerable
this is a test
如果是没有问题，则是下面
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
第 1 条附言 · 2014-09-26 08:15:36 +08:00
补充一下这个问题的危害：
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.
简单的http攻击的例子(ddos?)
Http头里如果这样写：
http-header = Host:() { :; }; ping -c 3 8.8.8.8
貌似在服务器上就执行了ping
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.
简单的http攻击的例子(ddos?)
Http头里如果这样写：
http-header = Host:() { :; }; ping -c 3 8.8.8.8
貌似在服务器上就执行了ping
44 条回复 • 2014-09-26 15:31:02 +08:00
 |
1
Earthman 2014-09-25 11:35:24 +08:00
debian sid中招
|
 |
2
Bakemono 2014-09-25 11:39:16 +08:00
影响范围很大的。
我已经成功复现本地搭建的 cgi-bin 的网站，执行命令并且回显，目测很多都会沦陷掉.. |
 |
5
ccbikai 2014-09-25 11:54:34 +08:00
手里的五台都中………………
|
 |
6
ryon 2014-09-25 12:03:18 +08:00
有修复方案了么
|
 |
7
icevil 2014-09-25 12:05:46 +08:00  1
|
 |
8
chenshaoju 2014-09-25 12:05:56 +08:00
|
 |
9
14 2014-09-25 12:07:55 +08:00
sudo apt-get update && sudo apt-get updrade 检测到bash更新，更新之后就好了~
|
 |
10
mml 2014-09-25 12:16:58 +08:00
这个补丁还是有问题，继续关注等更新吧。
|
 |
11
moname 2014-09-25 12:19:51 +08:00
一早起来就update了
|
 |
12
cielpy 2014-09-25 12:23:00 +08:00
中招了。。
|
|
15
Bakemono 2014-09-25 13:10:55 +08:00 1
|
 |
16
loveminds 2014-09-25 13:12:28 +08:00
没记错的话bash应该不是setuid的程序吧
|
 |
17
lightforce 2014-09-25 13:12:42 +08:00
env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "still vulnerable :("
|
 |
18
GTim 2014-09-25 13:23:36 +08:00
我的macbook 肿么办
|
 |
19
q397064399 2014-09-25 13:29:44 +08:00
@GTim 这个貌似也得先取得user权限吧
|
|
20
q397064399 2014-09-25 13:38:19 +08:00
@Bakemono 如何利用？ 用php先取得用户权限 执行shell 然后用这个漏洞提升到root?
|
|
21
Bakemono 2014-09-25 13:51:33 +08:00
@q397064399 利用方法我已经写了，不需要任何权限，只要是 *纯bash* 的 cgi 就可以，当然我只测试了 apache 的
|
 |
22
duzhe0 2014-09-25 14:23:58 +08:00
debian的默认shell是dash， 所以debian的服务器受影响应该比较小。
|
 |
27
jiang42 2014-09-25 15:31:07 +08:00
freeBSD 10.0中招
|
 |
28
pimin 2014-09-25 15:41:19 +08:00
|
 |
29
iac 2014-09-25 15:46:02 +08:00
有没有比较快速的漏洞披露平台求推荐
|
 |
31
paloalto 2014-09-25 17:05:27 +08:00
[root@li566-238 ~]# $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
-bash: $: command not found 哈哈哈哈哈哈 |
 |
32
zhoulujue 2014-09-25 17:07:09 +08:00
bash: 警告: x: ignoring function definition attempt
bash: `x' 函数定义导入错误 this is a test |
 |
35
miyuki 2014-09-25 20:11:17 +08:00 via Android
阿里云bash貌似也是 刚才接到了了紧急通知
|
 |
36
GPU 2014-09-25 20:23:28 +08:00
有一台中招了。
|
 |
37
Tz101 2014-09-25 20:31:19 +08:00 via Android
手头的Android也中招了
|
 |
38
lwbjing 2014-09-25 20:58:23 +08:00
centos 6.5中招，已修复。
|
 |
39
P9 2014-09-25 21:02:07 +08:00
这个原理是？？？？
|
 |
40
tideline 2014-09-25 22:20:48 +08:00
Macbook 中招😭
|
|
41
Earthman 2014-09-25 22:35:15 +08:00
今晚更新后没问题了
|
 |
43
windyboy OP |
 |
44
fork3rt 2014-09-26 15:31:02 +08:00
用zsh的飘过
|
Select Language