3 ms·
My server actually got hacked through this. I patched the first vulnerability quickly (arch linux, just did pacman -Sy bash). The second vulnerability was publi
by shawabawa3 12y ago
My server actually got hacked through this. I patched the first vulnerability quickly (arch linux, just did pacman -Sy bash). The second vulnerability was published overnight, tried to ssh to my box to patch it in the morning: "enter password:" - uh oh, I use public key auth
My server runs a couple of wordpress sites and a rails app - not sure where the vulnerability was exploited but be warned, looks like bots are already crawling for it
- Erwin 12y agoHuh. I thought the second issue did not have an exploit? That when set, all would happen was that running "X Y" via a shell could instead run "Y > X " ?
- scintill76 12y agoIf the attacker can control a list of arguments and an env var value, you're back to arbitrary command execution, albeit redirected somewhere. That sounds suspiciously insecure even without bash vulnerabilities, though. Would be interesting if GP knows what they used.
- shawabawa3 12y agoI have no idea, I wasn't able to access any logs or anything. It's possible they had already installed a backdoor using the first vulnerability before I patched it, or perhaps something else entirely (though that's a little too coincidental)