Linux re-exposure security vulnerability bash damage will be super-painstaking

September 25 Message: a Linux security vulnerability that is alleged to be more severe than "bleeding heart" was found, although no attack was found to exploit the vulnerability, but a lower operating threshold than "heart bleed" made it more dangerous than the former.

Bash is the software used to control the command prompt for a Linux computer. "Bleeding with the heart" allows hackers to spy on the computer but does not allow hackers to gain control of the computer, said Dan Gido, chief executive of Trail of bits of cyber security. Bash vulnerabilities are different, and hackers can use it to fully control the target computer system.

To make things worse, it's easier to take advantage of bash vulnerabilities by simply cutting and pasting a single line of software code to get results. Such a low threshold may attract more hackers to attack, which is where security experts are worried.

Tode Birzley, an engineering manager at Rapid7, the network security company, said the severity of the Bash vulnerability was rated at level 10, and the difficulty was rated as "low", which means more hackers could use it to create a more serious security crisis.

"Exploiting this vulnerability, an attacker could take over the entire operating system of the computer, Access confidential information, make changes to the system, and so on," Beardsley said. Anyone's computer system, if using bash software, needs to be patched immediately. ”

Experts recommend that conditional enterprise users can make unnecessary server disconnection to protect the server from bash vulnerabilities until the vulnerability is fixed.

Since the personal corporate server is Ubuntu's concern for such issues, here are the solutions for Red Hat and Ubuntu users to refer to.

If you have questions can add me: Weilai_lee Exchange.

Serious Bash Vulnerability Warning (cve-2014-6271)

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which a Llows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving Command feature in OpenSSH sshd, the mod_cgi and Mod_cgid modules in the Apache HTTP Server, scripts executed by Unspecifi Ed DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execut Ion.

Authentication:not required to exploit

Impact Type:allows unauthorized disclosure of information; allows unauthorized modification; Allows disruption of service

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-6271

http://seclists.org/oss-sec/2014/q3/650

Https://blogs.akamai.com/2014/09/environment-bashing.html

The solution given by Red Hat system:

This problem can be resolved by updating bash and rebooting the system:

?

1	# yum update bash

Or:

?

1	# yum update bash-4.1.2-15.el6_5.1

This only updates the bash package and requires a system restart to take effect.

Ubuntu Users

You can use the following command to patch, without restarting:

?

12	apt-get update apt-get  install bash

Above from: Ladder net

Linux re-exposure security vulnerability bash damage will be super-painstaking