# MA-417.092014: MyCERT Alert - GNU Bourne Again Shell Vulnerability

**Date:** 26 Sep 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-417.092014  
**Advisory ID:** MA-417.092014

---

**1.0 Introduction**
MyCERT received information from valid sources regarding a GNU Bash vulnerability that affects Unix-based operating systems such as Ubuntu, Red Hat, Debian, Linux and Mac OS X as well as a lot of web servers running Linux operating systems.
GNU Bourne Again Shell or GNU Bash, perhaps one of the most installed utilities on any Linux system is a computer program that's installed on millions of computers and servers around the world. Bash has evolved from a simple terminal based command interpretater to many various uses since its creation inthe 1980s and it has become an industry standard.
**2.0 Affected Systems**
The vulnerability exists for servers running UNIX-based systems as below:
Apple
OSX
BSD
Redhat
Debian
CentOS
Ubuntu
**3.0 Brief Description**
OS Command Injection
Bash supports exporting of shell functions to other instances of bash using an environment variable. This environment variable is named by the function name and starts with a "() {" as the variable value in the function definition. When Bash reaches the end of the function definition, rather than ending execution it continues to process shell commands written after the end of the function. This vulnerability is especially critical because Bash is widespread on many types of devices (UNIX-like operating systems including Linux, BSD, and Mac OS X), and because many network services utilize Bash, causing the vulnerability to be network exploitable.
**4.0 Impact**
The impact of this vulnerability is it may allow a remote attacker to execute arbitrary code on an affected system.
Once attackers had exploited this vulnerability and gain unauthorised access, he could deface websites, steal confidential or sensitive data and engage in malicious activities such as malware activities, botnets that can be used for spam and DDOS activities.
**5.0 Recommendation**
a) Detection/Diagnostics
The servers are vulnerable depends on whether the application setup invokes Bash as part of the code execution.
To check if you are patched, you can use the original test string:
*env x='() { ;;}; echo vulnerable' sh -c "echo this is a test"*
If you are patched, but want to demonstrate that you are still vulnerable, you can use this command:
*env x='() { (a)=>\' bash -c "v echo vulnerable"; cat v*
This command will return an error on a patched system, but it will still create an file called "v" containing the string "vulnerable". This can be abused to perform arbitrary command execution.
b) Apply Patch
System Administrators may refer to the below information about patches to fix this vulnerability:
- Red Hat: <https://rhn.redhat.com/errata/RHSA-2014-1306.html>
- Ubuntu: <http://www.ubuntu.com/usn/usn-2363-2/>
- Debian: <http://www.debian.org/security/2014/dsa-3035>
c) Mitigations
Redhat had provided workarounds to block attacks against web services, such as attacks against CGI applications.
The workarounds are using mod\_security and IP Tables available at:
<https://access.redhat.com/articles/1200223>
Please take note that these are weak workaround as an attacker could easily send one or two characters per packet, which would avoid matching this signature check. It may, in conjunction with logging, provide an overview of automated attempts at exploiting this vulnerability.
MyCERT generally advise users of this product to keep themselves updated with the latest security announcements by the vendor. If users have any enquiries on this matter, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 on call incident reporting)
SMS : CYBER999 REPORT to 15888
Business Hours : Mon - Fri 09:00 -18:00 MYT
Web: https://www.mycert.org.my
**6.0 Reference**
- <http://www.vox.com/2014/9/25/6843949/the-bash-bug-explained>
- <http://www.kb.cert.org/vuls/id/252743>
- <https://www.us-cert.gov/ncas/current-activity/2014/09/24/Bourne-Again-Shell-Bash-Remote-Code-Execution-Vulnerability>
- <https://access.redhat.com/articles/1200223>
- <https://www.debian.org/security/2014/dsa-3032>
- <http://lists.centos.org/pipermail/centos/2014-September/146099.html>
- <https://isc.sans.edu/index_cached.html>
- <https://www.cert.gov.au/advisories>