[dropzon3]

Hmm, Ubuntu says it only affects ubuntu, so it would affect Debian or kali right?

It affects bash itself. Ubuntu is only going to mention Ubuntu because well that is their area of responsibility. If you read the Debian security stuff you'll see the affected debian information. The issue is with bash though so its pretty universal.

You can check if you're vulnerable to it pretty easily by just trying this command from your shell/terminal

Code:

export _test='() { :;}; echo VULNERABLE'; bash -c 'echo test'

If you see VULNERABLE be echo'd then the machine is vulnerable:

Code:

dropzon3@rex:~$ export _test='() { :;}; echo VULNERABLE'; bash -c 'echo test' VULNERABLE test dropzon3@rex:~$

If you don't see VULNERABLE printed then its been patched(though the patches so far have only been partial) If its your own *nix machine that has bash(default on pretty much every distro) and you havn't updated its a safe bet that you are vulnerable as this bug has existed for 20 some years.

Of course being vulnerable doesn't mean its exploitable. Ie. Running Kali unless you're running some public services for the internet its not exploitable remotely(and local exploitation isn't useful as it doesn't escalate privs)

EDIT:

They released a patch for it, yes, but it turns out they're still vulnerable afterwards.

Yup my bad just read about the new patch, it's supposedly much harder to exploit though and a new patch is being worked on as we speak and should be released fairly soon.

Exploitation is different but not harder. CVE-2014-7169 exploit its still a trivially exploited bug even with the patch. The original test string for the post-patch exploit was this:

Code:

env X='() { (a)=>\' sh -c "echo date"; cat echo

https://twitter.com/taviso/statuses/514887394294652929

You might want to change sh to bash though (some systems sh points to bash but not all).

[dropzon3]

Hmm, Ubuntu says it only affects ubuntu, so it would affect Debian or kali right?

It affects bash itself. Ubuntu is only going to mention Ubuntu because well that is their area of responsibility. If you read the Debian security stuff you'll see the affected debian information. The issue is with bash though so its pretty universal.

You can check if you're vulnerable to it pretty easily by just trying this command from your shell/terminal

Code:

export _test='() { :;}; echo VULNERABLE'; bash -c 'echo test'

If you see VULNERABLE be echo'd then the machine is vulnerable:

Code:

dropzon3@rex:~$ export _test='() { :;}; echo VULNERABLE'; bash -c 'echo test' VULNERABLE test dropzon3@rex:~$

If you don't see VULNERABLE printed then its been patched(though the patches so far have only been partial) If its your own *nix machine that has bash(default on pretty much every distro) and you havn't updated its a safe bet that you are vulnerable as this bug has existed for 20 some years.

Of course being vulnerable doesn't mean its exploitable. Ie. Running Kali unless you're running some public services for the internet its not exploitable remotely(and local exploitation isn't useful as it doesn't escalate privs)

EDIT:

They released a patch for it, yes, but it turns out they're still vulnerable afterwards.

Yup my bad just read about the new patch, it's supposedly much harder to exploit though and a new patch is being worked on as we speak and should be released fairly soon.

Exploitation is different but not harder. CVE-2014-7169 exploit its still a trivially exploited bug even with the patch. The original test string for the post-patch exploit was this:

Code:

env X='() { (a)=>\' sh -c "echo date"; cat echo

https://twitter.com/taviso/statuses/514887394294652929

You might want to change sh to bash though (some systems sh points to bash but not all).