Shellshock subsequent Vulnerabilities

Shellshock subsequent Vulnerabilities

CVE-2014-6277 and CVE-2014-6278 finally exposed.

POC:

Bash-c "f () {x () {_ ;}; x () {_ ;}< <;}"

Michal zarewski, the discoverer of the vulnerability, gave a detailed analysis. The BASH community patch is still being urgently repaired because it involves some of the tough problems in backporting, it is expected that UPSTREAM will be restored by the end of this week. That is to say, the GNU/Linux release should be repaired at the earliest this weekend or next week. During this period, it is especially dangerous for servers in the production environment.

There are two ways to reduce risks:

1. ASLR/PIE/NX/CANARY/RELRO reinforced Bash redeployment
2. Make sure that your machine uses at least the Florian weilian patch.

Gitlab-shell is affected by Bash CVE-2014-6271 Vulnerability

Linux security vulnerability exposure Bash is more serious than heartbleed

The solution is to upgrade Bash. Please refer to this article.

Bash remote parsing command execution vulnerability Test Method

This article permanently updates the link address: