Unix/Linux/Mac OSX Bash Vulnerability ("Shellshock")

Last updated 10/09/2014 12:00 PM

General Information and Background:

Very brief introduction to Bash

Bash is a Unix shell that runs on a huge number of computers worldwide, and is the default for most of the popular Linux releases. As you've no doubt heard, a major security vulnerability was discovered in this shell on September 24th 2014. The initial vulnerability was discovered and quickly patched on 9/24. However, it was then discovered that the initial patch was incomplete and an additional patch was released on 9/26 that (theoretically) is a complete fix for the issue.

Since the majority of UCD Physics Faculty, Grad Students, Postdocs, etc, use some form of Linux or Mac OSX, it is critical that you ensure your system is secure. The majority of Physics Staff use Windows, so this issue applies much less to those computers, except for very specific cases (continue reading...)

NOTE: The Physics IT Team is actively patching all major Physics servers and systems. As of 9/29/2014, all critical Physics servers have been patched, and the majority of total systems has been patched. We are actively scanning for any remaining unpatched systems (there are a lot of systems in Physics...). Please contact Physics IT at help@physics.ucdavis.edu if you need help patching your system(s), if you're a Faculty member, Postdoc, Grad Student, or are in any way affiliated with Physics. This especially applies to Faculty members who have purchased their systems that Physics IT may not be fully apprised of. In any case, if you're not sure, or want us to test your system's security, email us at help@physics.ucdavis.edu, call us at (530)752-4923, or come to the IT Office in room 536 during business hours.

What to Do

If you're using Windows, the only way your computer could be vulnerable is if you have installed cygwin or a similar port of unix tools. This could include bash, which would most likely be unpatched. (see section below, Cygwin on Windows). If you use any other operating system, included Apple's Mac OS X, see below for details.

Check if Your System is Vulnerable

Updated Test (9/26)

To test for for the additional flaws left unfixed by the 9/24 patch, type the following command in a terminal:

env X='() { (a)=>\' sh -c "echo date"; cat echo

bash: X: line 1: syntax error near unexpected token `='
bash: X: line 1: `'
bash: error importing function definition for `X'
Fri Sep 26 11:49:58 GMT 2014

date
cat: echo: No such file or directory

rm echo
env X='() { (a)=>\' sh -c "echo date"; cat echo

Original Test (9/24)

To test for the original (9/24) flaw, type the following command in a terminal:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

vulnerable
this is a test

bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test

Fixes:

Ubuntu and variants (Kubuntu, Xubuntu, Mint)

Current and LTS Versions (10.04, 12.04, 14.04, etc):: run the following command to update bash:

apt-get --only-upgrade install bash

apt-get install --reinstall bash

Other versions (12.10, 13.04, 9.x or lower):

These are no longer supported and an official patch has not been released. However, there are ways of compiling bash from source or using compatible binaries to secure the system. As a short term solution (for semi-advanced users), you could replace your bash binary with a symbolic link to another shell (for example, tcsh). This will ensure any user or program attempting to open bash will instead open tcsh. (This will "secure" the system in that bash will not be able to be exploited, but it may break users scripts and other things, not to mention the differences in syntax between bash and tcsh).Make sure to back up/make a copy of your original bash binary before you attempt this, just in case something goes wrong and you need to revert to bash temporarily.

Mac OSX:

Red Hat Enterprise Linux

(versions 4-7): see the Red Hat page on the vulnerability and note the updates regarding the 9/26 additional patches.

Fedora

The patch is being added has been added to the Fedora repositories so you should first try to run the following commands and then verify if the flaw has been resolved using the test script above.

sudo yum clean all
sudo yum update bash

sudo yum reinstall bash

CentOS

Please see: https://www.centosblog.com/criticical-bash-vulnerability-discovered-update-bash-centos-linux-server-now/

Scientific Linux

See https://www.scientificlinux.org/sl-errata/slsa-20141293-1/
UPDATE:9/26 patch that fixes the vulnerabilities left unpatched by the 9/24 patch. See https://www.scientificlinux.org/sl-errata/slsa-20141306-1/

Other *nix distros and Cygwin on Windows

This vulnerability also exists on these systems. There are now many tutorials available online on how to patch other versions of Linux/Unix as well as cygwin on Windows. Please be sure to update your system.