The issue is a flaw in the way Bash evaluates certain specially crafted environmental variables. An attacker could exploit this by bypassing environment restrictions to execute shell commands.
There are now 4 separate issues relating to this;
CVE-2014-6271
CVE-2014-7169
CVE-2014-7186
CVE-2014-7187
To check to see if your system is vulnerable run the following command as a non-root user;
env X='() { (a)=>\' sh -c "echo date"; cat echo
If a file called 'echo' is created in the current directory and it contains the date, you need to
patch your system.
Red Hat have produced a good FAQ on the whole issue.
Also, Virtualisation platforms that have a Linux element such as VMware ESX and ESXi
and XenServer will also be vulnerable.
No comments:
Post a Comment