How to Check Your Server for Bash Shellshock Vulnerability

The hosting world has been hit with yet another highly publicized server vulnerability. This one affects the ubiquitous shell program GNU Bash and is referred to as Shellshock. Most Linux, BSD and Mac OS X operating systems and variants use Bash or derivatives of it. All Bash versions between versions 1.14 and 4.3 are potentially vulnerable. Fortunately, it is easy to check for the vulnerability and easy to fix.

To test your Linux server for the vulnerability, login via SSH and type this command from the bash prompt:

env VAR='() { :;}; echo Bash is vulnerable!’ bash -c “echo Bash Test”

If the vulnerability is present, the output will look like this:

Bash is vulernable!

Bash Test

The “Bash is vulnerable” is the line where an attacker could potentially inject code through any service or program that uses bash scripting. These programs may be more prevalent than you might think. If your Bash installation is not vulnerable, the output will not print the “Bash is vulnerable” line but should still print “Bash Test”.

In the next post, we will cover ways to fix the vulnerability on a number of Linux distributions.