News - Informatique

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

curl https://shellshocker.net/shellshock_test.sh | bash

curl https://shellshocker.net/fixbash | sh

#!/bin/sh
##############################################################
# This is the ShellShocker.net bash updater script.
# Version 1.2!
#
# Are you looking at this in your web browser, and would like to apply the bash patches?
# Just open up your terminal and type:
#
#    curl https://shellshocker.net/fixbash | sh
########
# REV 4: Added prefix to configure for fedora systems.
# REV 5: Bumped patch to 26 from 25.
# REV 6: Bumped patch to 27 from 26.
# REV 7: Not using sudo when logged in as root: https://github.com/wreiske/shellshocker/pull/15
# REV 8: Updated loops to download and apply up to latest patch: https://github.com/wreiske/shellshocker/pull/17
# REV 9: Added check for gcc to be installed.
########
# This script will download bash 4.3 to your home directory, extract, download patches, patch,
# install patches, and install the fixed bash.
#   - Mac: OS X
#   - Linux: x86 and x86_64 systems
##############################################################
echo "----------------------------------------------"
echo "-- WELCOME TO THE SHELLSHOCKER BASH PATCHER --"
echo "----------------------------------------------"
echo "---     Revision 8, 092914-4:56PM ETC      ---"
echo "--- Provided by https://shellshocker.net/  ---"
echo "----------------------------------------------"
GCC=`which gcc`
PATCH=`which patch`
MAKE=`which make`
if [ -z "$GCC" ]; then
    echo "Your system does not have the GNU gcc complier installed."
    echo "Please install the gcc complier and then run this script again."
    exit 1
fi
if [ -z "$PATCH" ]; then
    echo "Your system does not have the GNU patch tool installed."
    echo "Please install the patch tool and then run this script again."
    exit 1
fi
if [ -z "$MAKE" ]; then
    echo "Your system does not have the GNU make tool installed."
    echo "Please install the make tool and then run this script again."
    exit 1
fi
echo "Creating folders..."
cd ~/
mkdir bash-shellshocker
cd bash-shellshocker
echo "Downloading Bash..."
wget -N https://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz
echo "Downloading Bash patches..."
i=0
while [ true ]; do i=`expr $i + 1`; wget -N https://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$(printf '%03g' $i); if [ $? -ne 0 ]; then break; fi; done
echo "Extracting bash from tar.gz..."
tar zxvf bash-4.3.tar.gz 
cd bash-4.3
echo "Applying Patches..."
for p in `ls ../bash43-[0-9][0-9][0-9]`; do patch -p0 < $p; done
echo "Ready to install. Configuring..."
./configure --prefix=/
echo "Running make"
make
if [ `id -u` -eq 0 ]
then
  echo "Running make install"
  make install
  cp /bin/bash /usr/local/bin/bash
  if [ $? -ne 0 ]; then
      cp /usr/local/bin/bash /usr/local/bin/bash.back
      cp -f /bin/bash /usr/local/bin/bash
  fi
else
  echo "Running make install  (You may need to type your sudo password here)"
  sudo make install
  sudo cp /bin/bash /usr/local/bin/bash
  if [ $? -ne 0 ]; then
      sudo cp /usr/local/bin/bash /usr/local/bin/bash.back
      sudo cp -f /bin/bash /usr/local/bin/bash
  fi
fi
echo "----------------------------------------------"
echo "Done! Try opening a new bash shell and checking if your system is still vulnerable."
echo "Script provided by https://shellshocker.net/"
echo "Please go leave a comment and let us know if this script worked for you!"
echo "Follow us on twitter too, https://twitter.com/shellshockernet"
echo "Send issue requests to https://github.com/wreiske/shellshocker/issues"
echo "Want to help make shellshocker better? Contribute @ https://github.com/wreiske/shellshocker/"
echo "-Thanks"
 

root@banane:/audio# curl https://shellshocker.net/shellshock_test.sh | bash
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2533  100  2533    0     0   3293      0 --:--:-- --:--:-- --:--:--  4613
CVE-2014-6271 (original shellshock): not vulnerable
CVE-2014-6277 (segfault): not vulnerable
CVE-2014-6278 (Florian s patch): not vulnerable
CVE-2014-7169 (taviso bug): not vulnerable
CVE-2014-7186 (redir_stack bug): not vulnerable
CVE-2014-7187 (nested loops off by one): not vulnerable
CVE-2014-//// (exploit 3 on http://shellshocker.net/): not vulnerable
root@banane:/audio# cat /etc/debian_version
7.6
root@banane:/audio# uname -a
Linux banane 3.14.5-customkernel #1 SMP Fri Jun 6 21:17:34 CEST 2014 x86_64 GNU/Linux
 

root@orange:~# bash --version
GNU bash, version 4.3.30(1)-release (i686-pc-linux-gnu)
Copyright (C) 2013 Free Software Foundation, Inc.
Licence GPLv3+ : GNU GPL version 3 ou ultérieure <http://gnu.org/licenses/gpl.html>
This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
root@orange:~# curl https://shellshocker.net/shellshock_test.sh | bash
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  2533  100  2533    0     0   2589      0 --:--:-- --:--:-- --:--:--  2589
CVE-2014-6271 (original shellshock): not vulnerable
CVE-2014-6277 (segfault): not vulnerable
CVE-2014-6278 (Florian s patch): not vulnerable
CVE-2014-7169 (taviso bug): not vulnerable
CVE-2014-7186 (redir_stack bug): not vulnerable
CVE-2014-7187 (nested loops off by one): not vulnerable
CVE-2014-//// (exploit 3 on http://shellshocker.net/): not vulnerable
root@orange:~# cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=13.10
DISTRIB_CODENAME=saucy
root@orange:~# uname -a
Linux orange 3.11.0-26-generic #45-Ubuntu SMP Tue Jul 15 04:04:15 UTC 2014 i686 i686 i686 GNU/Linux