Friday, September 26, 2014

ShellShock - bash bug - how to protect your server...

Basically you have to install updated version of bach. This can be done either with apt-get or yum or other command.

Use apt-get to protect server from ShellShock bash bug

root@(server):/# apt-get upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be upgraded:
  bash
1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 1,501 kB of archives.
After this operation, 297 kB of additional disk space will be used.
Do you want to continue [Y/n]? y
Get:1 http://security.debian.org/ wheezy/updates/main bash amd64 4.2+dfsg-0.1+deb7u3 [1,501 kB]
Fetched 1,501 kB in 1s (906 kB/s)
Reading changelogs... Done
(Reading database ... 29743 files and directories currently installed.)
Preparing to replace bash 4.2+dfsg-0.1+deb7u1 (using .../bash_4.2+dfsg-0.1+deb7u3_amd64.deb) ...
Unpacking replacement bash ...
Processing triggers for man-db ...
Processing triggers for menu ...
Setting up bash (4.2+dfsg-0.1+deb7u3) ...
update-alternatives: using /usr/share/man/man7/bash-builtins.7.gz to provide /usr/share/man/man7/builtins.7.gz (builtins.7.gz) in auto mode
Processing triggers for menu ...

Using yum to protect server from ShellShock bash bug

[root@ip-********* ec2-user]# yum update
Loaded plugins: changelog, priorities, update-motd, upgrade-helper, verify
amzn-main/latest                                                                                                                                     | 2.1 kB     00:00
amzn-updates/latest                                                                                                                                  | 2.3 kB     00:00
amzn-updates/latest/updateinfo                                                                                                                       | 180 kB     00:00
amzn-updates/latest/primary_db                                                                                                                       | 4.9 kB     00:00
epel/x86_64/metalink                                                                                                                                 |  16 kB     00:00
epel/x86_64                                                                                                                                          | 4.4 kB     00:00
epel/x86_64/updateinfo                                                                                                                               | 865 kB     00:00
epel/x86_64/primary_db                                                                                                                               | 6.3 MB     00:02
epel/x86_64/pkgtags                                                                                                                                  | 1.2 MB     00:00
rpmforge                                                                                                                                             | 1.9 kB     00:00
1560 packages excluded due to repository priority protections
Resolving Dependencies
--> Running transaction check
---> Package bash.x86_64 0:4.1.2-15.17.amzn1 will be updated
---> Package bash.x86_64 0:4.1.2-15.21.amzn1 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

============================================================================================================================================================================
 Package                            Arch                                 Version                                           Repository                                  Size
============================================================================================================================================================================
Updating:
 bash                               x86_64                               4.1.2-15.21.amzn1                                 amzn-updates                               1.3 M

Transaction Summary
============================================================================================================================================================================
Upgrade  1 Package

Total download size: 1.3 M
Is this ok [y/d/N]: y
Downloading packages:
bash-4.1.2-15.21.amzn1.x86_64.rpm                                                                                                                    | 1.3 MB     00:00
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Updating   : bash-4.1.2-15.21.amzn1.x86_64                                                                                                                            1/2
  Cleanup    : bash-4.1.2-15.17.amzn1.x86_64                                                                                                                            2/2
  Verifying  : bash-4.1.2-15.21.amzn1.x86_64                                                                                                                            1/2
  Verifying  : bash-4.1.2-15.17.amzn1.x86_64                                                                                                                            2/2

Updated:
  bash.x86_64 0:4.1.2-15.21.amzn1

Complete!