How to modify major security vulnerabilities detected by Bash in Linux: linuxbash
On July 15, September 25, Beijing time, a Linux User got another "surprise" today "! The Red Hat security team found a hidden and dangerous security vulnerability in the Bash shell widely used in Linux. This vulnerability is called "Bash Bug" or "Shellshock ".
This vulnerability allows attackers to execute code in the same way as they do in Shell, which opens the door for various attacks. What's worse, this vulnerability has existed in Linux for a long time, so it is easy to fix a Linux machine, but it is almost impossible to fix it all.
Red Hat and Fedora have released patches for this vulnerability. This vulnerability also affects OS X, but Apple has not released a formal patch.
This Bash vulnerability may be more dangerous than Heartbleed.
--Robert Graham (@ ErrataRob) February September 24, 2014
Red Hat's Robert David Graham compared the vulnerability with Heartbleed and found that the former is more widely distributed and may have long-term impact on system security. Graham wrote in a blog article: "There are a lot of software that interacts with Shell in some way, and we cannot list all the software affected by this vulnerability ." According to The Verge report, Berkeley's researcher Nicholas Weaver also agreed: "It is very obscure, terrible, and will be with us for years ."
Todd Beardsley, manager of the network security company Rapid7 Engineering Department, warned that the severity of the Bash vulnerability is "10", which means it has the largest threat to users' computers. The complexity of Bash vulnerability exploitation is "low", which means that hackers can use it to launch attacks relatively easily.
In addition, Dan Guido, CEO of Trail of Bits, a network security company, said the "Heartbleed" vulnerability allows hackers to monitor users' computers, but does not gain control (www.111cn.net. The method to exploit the Bash vulnerability is simpler-you only need to cut and paste a line of code.
Google's security researcher Tavis Ormandy said on Twitter that the patches launched by Linux system providers appeared to be "incomplete", which raised concerns of several security experts. (Editor/single pearl)
This article is reproduced in Linux China. The original Article is from The Verge, and some content has been deleted and modified.
At present, the 360 security center should release the "Bash" vulnerability testing method, and remind websites and enterprises to promptly update the server security patch to avoid major risks.
"Bash" Vulnerability Testing Method
1) Local Test
Env x = '() {:;}; echo vulnerable' bash-c "echo this is a test"
2) Remote Testing
First, use BASH to write a CGI
Root @ kali:/usr/lib/cgi-bin # cat bug. sh
#! /Bin/bash
Echo "Content-type: text/html"
Echo ""
Echo 'Echo 'Echo '<meta http-equiv = "Content-Type" content = "text/html; charset = UTF-8">'
Echo '<title> PoC </title>'
Echo 'Echo '<body>'
Echo '<pre>'
/Usr/bin/env
Echo '</pre>'
Echo '</body>'
Echo 'Exit 0
Put it in/usr/lib/cgi-bin and use curl to access
The environment variables can be printed. It indicates that the access is normal. A shell is rebounded below
Access results:
From: http://www.111cn.net/sys/linux/67041.htm
How should I select i386, amd, armel, armhole, ISO, and vmware? What is the standard difference.
I7 2640 M
How does Linux bash shell change part of the text?
First, check the number of rows of the content you want to modify.
# Cat-An file
Use sed to replace it.
For example, replace 5th in rows 184 to 10 with 186.
# Sed-I '5, 10 s/184/186/G' file
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
