[Vulnerability notice] CVE-2014-6271: Linux Bash remote code execution vulnerability

On September 24, 2014, it was found that Bash, a built-in software of Linux, had a high-risk remote command execution vulnerability of which the CVE number was CVE-2014-6271.

Bash is widely used by Linux users to control cmd.exe, and thus the impact scope of this vulnerability is great. Besides, when the HTTP server opens CGI or Bash is introduced in other places, the remote command execution vulnerability occurs. Affected are mainstream Linux operating systems, including Ubuntu, CentOS, Debian, SUSE, and Redhat.

The vulnerability mainly impacts services and programs opened based on Bash. When a website uses CGI to run Bash, the attacker may remotely run a system command to rebound the shell to perform such operations as intranet infiltration, Trojan embedding, homepage tempering, resulting in high risks.

Alibaba Cloud informs you to follow the vulnerability information and troubleshoot and fix the vulnerability as soon as possible.

See the following for more information about the vulnerability.

CVE identifier

CVE-2014-6271

Vulnerability name

Linux Bash remote command execution vulnerability

Vulnerability rating

High

Vulnerability description

This vulnerability is caused by special environment variables created before Bash shell is called. These variables can contain code that can be run by Bash.

Condition and method of exploitation

Remote exploitation.

Affected scope

Linux operating systems of which the version of GNU Bash is 4.3 or earlier

Vulnerability detection

Run the command env x='() { :;}; echo vulnerable' bash -c "echo this is a test" to check whether the vulnerability exists.

If the returned message contains “vulnerable”, the vulnerability exists; otherwise, the vulnerability does not exist.

For example, if the vulnerability exists, the output before the vulnerability is fixed is:

vulnerable
this is a test

After the vulnerability is fixed, the output is:

bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x`
this is a test

Note: This detection method has no effect on your business. If your script defines the environment variables in the preceding way, an error is reported for your script execution after the vulnerability is fixed.

How to fix or mitigate

Note: Select the fixing command according to your Linux version. To avoid any accident, before executing the command, create a snapshot for your Linux server system disk. You can roll back the system disk snapshot to remove any impact on your server usage caused by the upgrade.

• Centos & Redhat:

  yum -y update bash

• Ubuntu:

  sudo apt-get update && sudo apt-get install bash

  The following message is prompted when you run the preceding code:

  bash: warning: x: ignoring function definition attempt
  bash: error importing function definition for `x`
  hello

• Debian:

  apt-get -y install --only-upgrade bash

Reference

[1]. Bash
[2]. Resolutionfor Bash Code Injection Vulnerability via Specially Crafted EnvironmentVariables (CVE-2014-6271, CVE-2014-7169) in Red Hat Enterprise Linux
[3]. [CentOS]Critical update for bash released today By Jim Perrin jperrin
[4]. CVE-2014-6271in Ubuntu (Canonical Ltd.)
[5]. oss-secmailing list archives
[6]. Bashspecially-crafted environment variables code injection attack
[7]. Bashbug as big as HeartbleedBy Robert Graham
[8]. CVE-2014-6271(Debian)