PS If you want to see if your system is vulnerable you can run the following commands in a shell: env X="() { :;} ; echo busted" /bin/sh -c "echo completed" env X="() { :;} ; echo busted" `which bash` -c "echo completed" if you see "busted" followed by "completed" as output, you are vulnerable. If you only see "completed", you already got the patch for bash and are secure. example: unpatched: root@ns5000179:~# env X="() { :;} ; echo busted" /bin/sh -c "echo completed" busted completed patched: root@vps43313:~# env X="() { :;} ; echo busted" /bin/sh -c "echo completed" completed 73s Robbie ON4SAX On Fri, Sep 26, 2014 at 10:34 PM, Robbie De Lise <robbie.delise(a)gmail.com> wrote:

Greetings to everybody. Shellshock still advancing: 180.186.121.254 - - [15/Oct/2014:13:04:01 +0200] "GET /cgi-bin/load.cgi HTTP/1.1" 404 478 "-" "() { :;}; echo `echo xbash:test`" 180.186.121.254 - - [15/Oct/2014:13:04:02 +0200] "GET /cgi-bin/test.cgi HTTP/1.1" 404 478 "-" "() { :;}; echo `echo xbash:test`" 180.186.121.254 - - [15/Oct/2014:13:04:03 +0200] "GET /cgi-bin/index.cgi HTTP/1.1" 404 479 "-" "() { :;}; echo `echo xbash:test`" 180.186.121.254 - - [15/Oct/2014:13:04:03 +0200] "GET /cgi-bin/help.cgi HTTP/1.1" 404 478 "-" "() { :;}; echo `echo xbash:test`" 180.186.121.254 - - [15/Oct/2014:13:04:04 +0200] "GET /cgi-bin/vidredirect.cgi HTTP/1.1" 404 485 "-" "() { :;}; echo `echo xbash:test`" 180.186.121.254 - - [15/Oct/2014:13:04:04 +0200] "GET /cgi-bin/click.cgi HTTP/1.1" 404 479 "-" "() { :;}; echo `echo xbash:test`" 180.186.121.254 - - [15/Oct/2014:13:04:04 +0200] "GET /cgi-bin/details.cgi HTTP/1.1" 404 481 "-" "() { :;}; echo `echo xbash:test`" 180.186.121.254 - - [15/Oct/2014:13:04:05 +0200] "GET /cgi-bin/log.cgi HTTP/1.1" 404 477 "-" "() { :;}; echo `echo xbash:test`" 180.186.121.254 - - [15/Oct/2014:13:04:05 +0200] "GET /cgi-bin/viewcontent.cgi HTTP/1.1" 404 485 "-" "() { :;}; echo `echo xbash:test`" 180.186.121.254 - - [15/Oct/2014:13:04:06 +0200] "GET /cgi-bin/content.cgi HTTP/1.1" 404 481 "-" "() { :;}; echo `echo xbash:test`" 180.186.121.254 - - [15/Oct/2014:13:04:07 +0200] "GET /cgi-bin/admin.cgi HTTP/1.1" 404 479 "-" "() { :;}; echo `echo xbash:test`" 180.186.121.254 - - [15/Oct/2014:13:04:07 +0200] "GET /cgi-bin/userreg.cgi HTTP/1.1" 404 481 "-" "() { :;}; echo `echo xbash:test`" 180.186.121.254 - - [15/Oct/2014:13:04:08 +0200] "GET /cgi-bin/mailview.cgi HTTP/1.1" 404 482 "-" "() { :;}; echo `echo xbash:test`" Above IP sent 13 variations of "test" untill I made new fail2ban trap rule. Keep sharp lookout! Best regards. Tom - sp2lob

The first patch to bash fixed for the initial tests. Here is a test for the initial patched bash that showed another problem... env X='() { (a)=>\' sh -c "echo date"; cat echo Prints the date if there is trouble. Debian updated the stable distrib this morning to catch the new exploit. Unfortunately there seems to be even more trouble coming: http://tinyurl.com/mzvcgbc If you are running debian stable the default shell is dash which is safe but if you upgraded from an older release in stages (say etch->squeeze->wheezy) you may not be using dash. ls -l /bin/sh Check to see where the symlink points to. to "fix" make sure dash is installed: sudo apt-get install dash then use the /etc/alternatives method to set it as the default: sudo update-alternatives --install /bin/sh sh /bin/dash 1 make sure it's set: sudo update-alternatives --config sh Hand check this afterwards: ls -l /bin/sh should return: lrwxrwxrwx 1 root root 20 Sep 27 00:15 /bin/sh -> /etc/alternatives/sh ls -l /etc/alternatives/sh should return: lrwxrwxrwx 1 root root 9 Sep 27 00:15 /etc/alternatives/sh -> /bin/dash To be safe I restarted my apache server and mail system after the change. Finally check your password file to see if bash is being explictly used: grep bash /etc/passwd If it is, I suggest you edit your password file so it uses /bin/sh after making the changes above. If you are on a non-debian system you should search your vendors configuration to see how to change the default shell. I don't particularily like dash but it's supposed to be safe. If you can't live without the features of bash you can just run it after logging in interactively. Bob (N0QBJ) "Brian <n1uro(a)n1uro.ampr.org> says:" -- /~\ The ASCII | Bob Brose N0QBJ \ / Ribbon Campaign | http://www.qbjnet.com/ X Help cure | mailto:bob@qbjnet.com / \ HTML Email | public key at http://www.qbjnet.com/key.html There are only 10 types of people in the world: Those who understand binary, and those who don't