Linux bash vulnerable on most modern Linux distributions

Came across an interesting post today from VentraIP which outlines that Linux bash is vulnerable on most modern Linux distributions. You can read more about it directly from them here.

I ran the command on a Raspbian install I have on a Raspberry Pi that hasn’t been updated for a few weeks and surprise surprise. It was vulnerable.

Before upgrade:

root@zulu:~# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test

After upgrade:

root@zulu:~# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test

Best we all go do a sweep of our systems and upgrade those all that would be impacted by this. Best to close the problem now before it gets exploited.

System security and sudo

Was reading twitter, as I would typically do when in transit. Came across a really good post on sudo[1] and security. Highly recommend having a read.

Check it out here.

Some excellent information contained in the post.

[1] – Sudo (su “do”) allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments.