[code紀錄]Bash security issue [vulnerability]

Hi  大家好  小弟來....

總之 這個議題  最近很紅....  小弟來跟一下 潮流XDDD

話說小弟 為了要更新bash ，反而導致Ubuntu 系統的GUI   ，login不進去。
只能用文字介面   Orz

參考 descent 大的文章
http://descent-incoming.blogspot.tw/2014/10/bash-vulnerability.html

主要就是裡面敘述的樣子...

假如你是 自己編譯要更新bash的話

參考這個 網址   選擇適合自己版本的更新檔

http://d.hatena.ne.jp/Kango/20140925/1411612246

CVE-2014-6271 Fixed Patch	BASH PATCH REPORT bash205b-008 BASH PATCH REPORT bash30-017 BASH PATCH REPORT bash31-018 BASH PATCH REPORT bash32-052 BASH PATCH REPORT bash40-039 BASH PATCH REPORT bash41-012 BASH PATCH REPORT bash42-048 BASH PATCH REPORT bash43-025
CVE-2014-7169 Fixed Patch	BASH PATCH REPORT bash205b-009 BASH PATCH REPORT bash30-018 BASH PATCH REPORT bash31-019 BASH PATCH REPORT bash32-053 BASH PATCH REPORT bash40-040 BASH PATCH REPORT bash41-013 BASH PATCH REPORT bash42-049 BASH PATCH REPORT bash43-026
CVE-2014-6277 CVE-2014-6278 Mitigated Patch	BASH PATCH REPORT bash205b-010 BASH PATCH REPORT bash30-019 BASH PATCH REPORT bash31-020 BASH PATCH REPORT bash32-054 BASH PATCH REPORT bash40-041 BASH PATCH REPORT bash41-014 BASH PATCH REPORT bash42-050 BASH PATCH REPORT bash43-027
CVE-2014-7186 CVE-2014-7187 Fixed Patch	BASH PATCH REPORT bash205b-011 BASH PATCH REPORT bash30-020 BASH PATCH REPORT bash31-021 BASH PATCH REPORT bash32-055 BASH PATCH REPORT bash40-042 BASH PATCH REPORT bash41-015 BASH PATCH REPORT bash42-051 BASH PATCH REPORT bash43-028
CVE-2014-6277 Fixed Patch	BASH PATCH REPORT bash205b-012 BASH PATCH REPORT bash30-021 BASH PATCH REPORT bash31-022 BASH PATCH REPORT bash32-056 BASH PATCH REPORT bash40-043 BASH PATCH REPORT bash41-016 BASH PATCH REPORT bash42-052 BASH PATCH REPORT bash43-029

想要測試 是否真的全部修復的話。

可以參考用以下方法

curl https://shellshocker.net/shellshock_test.sh | bash

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

                                 Dload  Upload   Total   Spent    Left  Speed

101  2533  101  2533    0     0   1688      0  0:00:01  0:00:01 --:--:--  2292

CVE-2014-6271 (original shellshock): not vulnerable

CVE-2014-6277 (segfault): not vulnerable

CVE-2014-6278 (Florian's patch): not vulnerable

CVE-2014-7169 (taviso bug): not vulnerable

CVE-2014-7186 (redir_stack bug): not vulnerable

CVE-2014-7187 (nested loops off by one): not vulnerable

CVE-2014-//// (exploit 3 on http://shellshocker.net/): not vulnerable

上面的結果是成功修復的話.

以上大概是這樣囉

感謝收看  下台一鞠躬