Hi devs,
I'm not a person who discovered this issue but I would like to share this with you.
According to source:
„On September 24, 2014, a GNU Bash vulnerability, referred to as Shellshock or the "Bash Bug", was disclosed. In short, the vulnerability allows remote attackers to execute arbitrary code given certain conditions, by passing strings of code following environment variable assignments. Because of Bash's ubiquitous status amongst Linux, BSD, and Mac OS X distributions, many computers are vulnerable to Shellshock; all unpatched Bash versions between 1.14 through 4.3 (i.e. all releases until now) are at risk.“
How to check if my machine is in a risk?
All you have to do is execute this code:
env 'VAR=() { :;}; echo Bash is vulnerable!' 'FUNCTION()=() { :;}; echo Bash is vulnerable!' bash -c "echo Bash Test"
If your output is „Bash Test“, then you are safe and you can continue without any troubles. In oposite case you have to be worried, because your input is „Bash is vulnerable!“ and your machine is not safe.
How do I become safe?
You should update version of bash ASAP. You can do it easily by executing this command:
pkg upgrade bash
Attention:
Now execute test program again and you should be safe, because it will give you correct output.
Sources:
[Hidden Content]
[Hidden Content]
[Hidden Content]