Security Bash Code Injection Vulnerability CVE-2014-6271 (update bash)

Very important update for all for Bash Code Injection Vulnerability CVE-2014-6271. More info at Red Hat Customer Portal and Bash Code Injection Vulnerability via Specially Crafted Environment Variables (CVE-2014-6271) - Red Hat Customer Portal.

Update 3: September 29th, 2014: We're not out of the woods completely, more vulnerabilities in bash ! New ones for CVE-2014-6277 (RedHat/CentOS not vulnerable) and CVE-2014-6278 (not yet patched for Redhat/CentOS) - (info at Further flaws render Shellshock patch ineffective - Security - News - iTnews.com.au and at lcamtuf's blog: Bash bug: apply Florian's patch now (CVE-2014-6277 and CVE-2014-6278)

Update 2: Bash shellshock FAQ by Redhat explaining CVE-2014-6271, CVE-2014-7169, CVE-2014-7186 and CVE-2014-7187

Update: if you're using Linode Xen VPS and still can't see the bash update for the CVE-2014-7169, read how to change the baseurl from Linode's here.

CentOS 6

Code:

yum list updates -q
Updated Packages
bash.x86_64                                                               4.1.2-15.el6_5.1                                                                updates

CentOS 7

Code:

 yum list updates -q
Updated Packages
bash.x86_64                      4.2.45-5.el7_0.2                        updates

2nd bash update is available for CVE-2014-7169

CentOS 6

Code:

yum list bash -q
Installed Packages
bash.x86_64             4.1.2-15.el6_5.1             @updates
Available Packages
bash.x86_64             4.1.2-15.el6_5.2             updates

CentOS 7

Code:

 yum list bash -q
Installed Packages
bash.x86_64            4.2.45-5.el7                 @anaconda
Available Packages
bash.x86_64            4.2.45-5.el7_0.4             updates 

CentOS 6

Code:

rpm -qa --changelog bash | head -n10
* Thu Sep 25 2014 Ondrej Oprala <ooprala@redhat.com> - 4.1.2-15.2
- CVE-2014-7169
  Resolves: #1146322

* Mon Sep 15 2014 Ondrej Oprala <ooprala@redhat.com - 4.1.2-15.1
- Check for fishy environment
  Resolves: #1141645

CentOS 7

Code:

rpm -qa --changelog bash | head -n10
* Thu Sep 25 2014 Ondrej Oprala <ooprala@redhat.com> - 4.2.45-5.4
- CVE-2014-7169
  Resolves: #1146324

* Thu Sep 25 2014 Ondrej Oprala <ooprala@redhat.com> - 4.2.45-5.3
- amend patch to match upstream's
  Related: #1146324

* Mon Sep 15 2014 Ondrej Oprala <ooprala@redhat.com - 4.2.45-5.2
- Fix-up the patch

For those using Oracle Linux 6.5

Code:

yum list bash -q
Installed Packages
bash.x86_64                                           4.1.2-15.el6_5.1.0.1                                            @ol6_latest

Code:

rpm -qa --changelog bash | head -n10
* Thu Sep 25 2014 John Haxby <john.haxby@oracle.com> - 4.1.2-15.1.0.1
- Preliminary fix for CVE-2014-7169

* Mon Sep 15 2014 Ondrej Oprala <ooprala@redhat.com - 4.1.2-15.1
- Check for fishy environment [CVE-2014-6271]
  Resolves: #1141645

Update bash for CentO, Redhat & Oracle Linux

1. In order to update to the most recent version of the Bash package run the following command:
   
   Code:

   yum clean all; yum update bash

2. Perform a system reboot [might not need a reboot] OR
3. if system cannot be reboot, run command
   
   Code:

   /sbin/ldconfig

Just updated 25+ servers

Bash YUM Updates

Looks like there maybe bash updates coming depending on the YUM mirror you use

actual announcements for 2nd bash update

• [CentOS-announce] CESA-2014:1306 Important CentOS 5 bash Security Update
• [CentOS-announce] CESA-2014:1306 Important CentOS 6 bash Security Update
• [CentOS-announce] CESA-2014:1306 Important CentOS 7 bash Security Update

Code:

Latest version for CentOS 5 bash-3.2-33.el5_10.4
Latest version for CentOS 6 bash-4.1.2-15.el6_5.2
Latest version for CentOS 7 bash-4.2.45-5.el7_0.4

Shellshock Malware

For the original bash vulnerability CVE-2014-6271 (shellshock), some folks might have been compromised or infected with shellshock malware. So it's a good idea to have a malware scanner. Centmin Mod has an addon for Linux Malware Detect (maldet) + ClamAV scanner (instructions for both manual install and included maldet.sh auto installer for Centmin Mod LEMP web stack users). Unfortunately, not sure if latest maldet definitions detect for shellshock malware right now, but it's better than not having a malware / virus scanner in place. However, maldet has several sources of malware data to generate it's LMD signatures

---

Spoiler: shellshock malware variants list

Code:

AVG    Linux/BackDoor_c.BV    20140926
Ad-Aware    Linux.Backdoor.F    20140926
AhnLab-V3    Linux/CVE-2014-6271    20140926
Avast    Other:Malware-gen [Trj]    20140926
Avira    LINUX/Flooder.538444    20140926
BitDefender    Linux.Backdoor.F    20140926
ClamAV    Linux.Flooder.Agent    20140926
Cyren    Unix/Flooder.AN    20140926
DrWeb    Linux.BackDoor.Shellshock.1    20140926
ESET-NOD32    Linux/DDoS.M    20140926
Emsisoft    Linux.Backdoor.F (B)    20140926
F-Prot    Unix/Flooder.AN    20140926
F-Secure    Backdoor:Linux/ShellShock.A    20140926
Fortinet    ELF/Gafgyt.A!tr    20140926
GData    Linux.Backdoor.F    20140926
Ikarus    Backdoor.Linux.ShellShock    20140926
K7AntiVirus    Trojan ( 0001140e1 )    20140926
K7GW    Trojan ( 0001140e1 )    20140926
Kaspersky    Backdoor.Linux.Gafgyt.a    20140926
McAfee    Linux/Dingle    20140926
MicroWorld-eScan    Linux.Backdoor.F    20140926
Norman    CVE_2014_6271.A    20140926
Qihoo-360    Trojan.Generic    20140926
Sophos    Troj/20146271-A    20140926
Symantec    Backdoor.Trojan    20140926
Tencent    Linux.Backdoor.Gafgyt.Suxo    20140926
TrendMicro    ELF_BASHLITE.A    20140926
TrendMicro-HouseCall    ELF_BASHLITE.A    20140926
ViRobot    Backdoor.Linux.S.BashEK.538444    20140926
nProtect    Linux.Backdoor.F    20140926

 

yup

 

Looks like another vulnerability in bash has been found Bash bug - in access.redhat.com | CVE-2014-7169

• Incomplete CVE-2014-6271 Fix - Bash Vulnerability
  
• oss-sec: CVE-2014-6271: remote code execution through bash
• access.redhat.com | CVE-2014-6271
• access.redhat.com | CVE-2014-7169
• Bash bug fallout: Are you Shell Shocked yet? You will be when this becomes a worm • The Register
• Another useful source of info and commentary on WHT at https://www.webhostingtalk.com/showthread.php?t=1414839

 

i believe that is for the first CVE-2014-6271 ?

for CVE-2014-6271 from Bash Code Injection Vulnerability via Specially Crafted Environment Variables (CVE-2014-6271) - Red Hat Customer Portal

But this is incomplete as there's another vulnerability as outlined further in https://access.redhat.com/articles/1200223

 

we're not out of the woods yet, still another to wait for fixing Bash Code Injection Vulnerability CVE-2014-6271 (update bash) | Centmin Mod Community heh

 

wait and see I guess...

 

As most folks need sleep, the update packages might come at anytime, so you can setup and install yum-cron so you get nightly yum updates along with email notifications.

Code:

yum -y install yum-cron
chkconfig yum-cron on

edit /etc/sysconfig/yum-cron to set MAILTO= email address for email notifications. If you use pushover.net for notifications to your mobile or tablet device, you can set

Code:

MAILTO=yourUSERkey@api.pushover.net

then start the yum-cron service

Code:

service yum-cron start

 

• Another useful source of info and commentary on WHT at https://www.webhostingtalk.com/showthread.php?t=1414839
• Looks like LiteSpeed web server has a virtual patch LiteSpeed Web Server Now Protected Against Shellshock « LiteSpeed Blog
• cPanel Security Team: Bash CVE-2014-6217 and CVE-2014-7169 - cPanel Forums
  
• How to Protect your Server Against the Shellshock Bash Vulnerability | DigitalOcean
  
• Troy Hunt: Everything you need to know about the Shellshock Bash bug
• Shellshock: What Is the Bash Bug? And Do You Need to Take Action? | Lifehacker UK
  
• Shellshock vulnerability roils Linux server shops | PCWorld
• Website Security - Shell Shock Vuln Actively Attacked | Sucuri Blog
• Website Security - Bash "Shell Shock" Vulnerability Impacts CPANEL Users | Sucuri Blog
• Concern over Bash vulnerability grows as exploit reported “in the wild” [Updated] | Ars Technica
• Bash Vulnerability Exploit Emerges in the Wild
• Shell Attack On Your Server: Bash Bug 'CVE-2014-7169' and 'CVE-2014-6271' | Security Intelligence Blog | Trend Micro

Looks like I am starting to get notifications from some web hosting and cloud providers about the bash vulnerability and the reminder for the need to update bash.

From Rightscale.com

From GoGrid.com

From Sucuri

From WHM/Cpanel cPanel Security Team: Bash CVE-2014-6217 and CVE-2014-7169 - cPanel Forums

from Amazon AWS ALAS-2014-418

from Amazon forum discussion https://forums.aws.amazon.com/thread.jspa?messageID=572002

 

Interesting info for virus/malware signatures picked up from various Anti-Virus providers for infections due to the original CVE-2014-6271 vulnerability (which the initial bash update would of fixed).

Comments tab might link to new detection analysis links at virustotal.com

• Antivirus scan for 73b0d95541c84965fa42c3e257bb349957b3be626dec9d55efcc6ebcba6fa489 at2014-09-26 00:18:10 UTC - VirusTotal
• Antivirus scan for ae3b4f296957ee0a208003569647f04e585775be1f3992921af996b320cf520b at2014-09-25 17:30:18 UTC - VirusTotal
• Antivirus scan for 2d3e0be24ef668b85ed48e81ebb50dce50612fb8dce96879f80306701bc41614 at2014-09-25 22:35:08 UTC - VirusTotal
• Antivirus scan for 73b0d95541c84965fa42c3e257bb349957b3be626dec9d55efcc6ebcba6fa489 at2014-09-26 00:18:10 UTC - VirusTotal
• Antivirus scan for 73b0d95541c84965fa42c3e257bb349957b3be626dec9d55efcc6ebcba6fa489 at2014-09-25 08:35:18 UTC - VirusTotal

 

So we know Amazon EC2 AMI images are auto updated at initial launch time for latest updates. But wonder about other cloud or VPS providers who provide OS image templates for Debian, Ubuntu, CentOS etc ? I know Vultr auto runs yum update on initialising their Vultr VPS instances as they actually run the OS's install routine to provision their OS (at least for CentOS) as opposed to some providers of OpenVZ, Xen and KVM which provide premade OS templates which may contain outdated bash versions ? Linode ? DigitaOean ? Rackspace ?

So might be good idea for Centmin Mod installs to endure a longer install time, by making sure yum update is run first ? Update: already added to .07 stable and .08 beta

Looks like Vultr has unattended security updates for Debian and Ubuntu Vultr VPSes a new worm? - VULTR

 

Looks like there maybe bash updates coming depending on the YUM mirror you use

actual announcements for 2nd bash update

• [CentOS-announce] CESA-2014:1306 Important CentOS 5 bash Security Update
• [CentOS-announce] CESA-2014:1306 Important CentOS 6 bash Security Update
• [CentOS-announce] CESA-2014:1306 Important CentOS 7 bash Security Update

Code:

Latest version for CentOS 5 bash-3.2-33.el5_10.4
Latest version for CentOS 6 bash-4.1.2-15.el6_5.2
Latest version for CentOS 7 bash-4.2.45-5.el7_0.4

edit: yup 2nd bash update is available

CentOS 6

Code:

yum list bash -q
Installed Packages
bash.x86_64             4.1.2-15.el6_5.1             @updates
Available Packages
bash.x86_64             4.1.2-15.el6_5.2             updates

CentOS 7

Code:

 yum list bash -q
Installed Packages
bash.x86_64            4.2.45-5.el7                 @anaconda
Available Packages
bash.x86_64            4.2.45-5.el7_0.4             updates 

Update bash for CentOS/Redhat

1. In order to update to the most recent version of the Bash package run the following command:
   
   Code:

   yum clean all; yum update bash

2. Perform a system reboot [might not need a reboot] OR
3. if system cannot be reboot, run command
   
   Code:

   /sbin/ldconfig

 

fix for 2nd vulnerability, shellshock is the 1st fixed update

CentOS 6

Code:

rpm -qa --changelog bash | head -n10
* Thu Sep 25 2014 Ondrej Oprala <ooprala@redhat.com> - 4.1.2-15.2
- CVE-2014-7169
  Resolves: #1146322

* Mon Sep 15 2014 Ondrej Oprala <ooprala@redhat.com - 4.1.2-15.1
- Check for fishy environment
  Resolves: #1141645

CentOS 7

Code:

rpm -qa --changelog bash | head -n10
* Thu Sep 25 2014 Ondrej Oprala <ooprala@redhat.com> - 4.2.45-5.4
- CVE-2014-7169
  Resolves: #1146324

* Thu Sep 25 2014 Ondrej Oprala <ooprala@redhat.com> - 4.2.45-5.3
- amend patch to match upstream's
  Related: #1146324

* Mon Sep 15 2014 Ondrej Oprala <ooprala@redhat.com - 4.2.45-5.2
- Fix-up the patch

 

yeah not all mirrors are populated with update yet, need to wait and check again. Out of 25+ of my servers like 6 don't have the update yet

make sure you do a yum clean all before too

Code:

yum clean all; yum update bash