4 ms·
Test code: ~$ bash -c "f() { x() { _;}; x() { _;} <<a; }" 2>/dev/null || echo vulnerable
by spacefight 12y ago
Test code:
~$ bash -c "f() { x() { _;}; x() { _;} <<a; }" 2>/dev/null || echo vulnerable
- dmix 12y agoHow to patch your system: https://shellshocker.net/ https://shellshocker.net/
- ZoFreX 12y agoThis is the same site that gives the above, incorrect, test. I would trust it about as far as I could throw it, and I assume it's bolted to the rack.
- ZoFreX 12y agoWhy does this mean I'm vulnerable? To what attack, exactly? My bash is already patched to not execute code in environment variables, so how is an attacker going to get the above exploit to be running in my shell? Edit: Using the other test further up thread (which does actually make use of environment variables), my system says "not vulnerable". I think this test is not perfect.
- deleted 12y ago[deleted]
- dspillett 12y agoOn up-to-date servers (according to aptitude) I get a segfault followed by the "vulnerable" message from that. Id the seg fault a red herring, or does it suggest I hve a verison of bash that attempts to filter out the problem?
- maximumoverload 12y agotry the other test posted above, this one is... strange