Page 1 of 2 12 LastLast
Results 1 to 10 of 19

Thread: BASH bug

  1. #1
    Senior Member
    Join Date
    Dec 2012
    Posts
    152

    BASH bug

    Are we vulnerable to the recently announced BASH bug?

  2. #2
    Moderator Moderator
    Join Date
    Nov 2010
    Location
    Germany/ Dietzenbach
    Posts
    1,124

  3. #3
    Senior Member
    Join Date
    Dec 2012
    Posts
    152
    Thanks Werner.

    "Nothing is terrible except fear itself" (Francis Bacon), later shamelessly paraphrased by F. D. Roosevelt when he declared that "Only thing to fear is fear itself".

  4. #4
    Senior Member registered user
    Join Date
    May 2006
    Location
    Columbia, Maryland USA
    Posts
    1,631

    A test you might try

    .
    There is a test one may use, and I have, which tells you something about Knoppix 7.4.1
    This test is given in a zdnet article you may find at.
    http://www.zdnet.com/shellshock-how-...rs-7000034072/

    An excerpt of this article says.
    So, how do you know if your servers can be attacked? First, you need to check to see if you're running a vulnerable version of Bash. To do that, run the following command from a Bash shell:

    env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

    If you get the result:

    vulnerable this is a test

    Bad news, your version of Bash can be hacked. If you see:

    bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' this is a test

    You're good. Well, to be more exact, you're as protected as you can be at the moment.
    FWIW, when I cut & paste the env x= ... line in a terminal, here's what I get.
    See the attached .png at full screen with Image Viewer.
    Attached Images Attached Images

  5. #5
    Moderator Moderator
    Join Date
    Nov 2010
    Location
    Germany/ Dietzenbach
    Posts
    1,124
    So, how do you know if your servers can be attacked?
    And? Has anyone in this forum a server running with Knoppix?

  6. #6
    Senior Member registered user
    Join Date
    May 2006
    Location
    Columbia, Maryland USA
    Posts
    1,631
    See the cited article.
    Summary: The Unix/Linux Bash security hole can be deadly to your servers.
    Here's what you need to worry about, how to see if you can be attacked,
    and what to do if your shields are down.

  7. #7
    Moderator Moderator
    Join Date
    Nov 2010
    Location
    Germany/ Dietzenbach
    Posts
    1,124
    Hello!

    Yes, I've read the article, but I cannot see any danger for me. I doesn't offer any services like httpd, ssh, nameserver. mailserver and so on outside of my LAN. All is restricted for locally use and within Knoppix this is also the default for any service.

  8. #8
    Senior Member registered user
    Join Date
    May 2006
    Location
    Columbia, Maryland USA
    Posts
    1,631
    Quote Originally Posted by Werner P. Schulz View Post
    I cannot see any danger for me.
    Hello, Werner.

    I believe you and Klaus K know you have no server worries with Knoppix.

    But, what should the amateur Knoppix user do to be as certain that
    he or she has not inadvertently enabled one or more vulnerable
    servers with their own peculiar choices of applications, usage and
    tweaks? And, is there an app for that?

    Respectfully.

  9. #9
    Moderator Moderator
    Join Date
    Nov 2010
    Location
    Germany/ Dietzenbach
    Posts
    1,124
    Hello!

    You cannot offer inadvertently a service like for example Apache worldwide without profound knowledge how to do it. And if somebody has this knowledge and offers those services worldwide, then it would be a very serious mistake to do it with a Live system, which doesn't has the ability for daily security updates.

    It's one thing, to run Apache for example within my home LAN or within the LAN for a computer course, and it is another thing to offer Apache service worldwide and clients from outside can attack my server.

    Therefore, keep calm and be pleased about some nice features, which you get with Bash and not Dash.

  10. #10
    Senior Member registered user
    Join Date
    May 2006
    Location
    Columbia, Maryland USA
    Posts
    1,631
    .
    One last question, then I'll stop pestering the moderator:

    Should I not worry about using cups, rsync, ssh and/or dhclient if
    these should 'serve' some purpose I don't presently need?
    If so, does this mean these are immune to bash bug vulnerability?

    Thanks in advance. I know all these uncertainties will vanish with 742,
    in any event.

Page 1 of 2 12 LastLast

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  


H261-Z61 2U 24SFF AMD Server 8x EPYC 7551 256-Cores 256GB RAM 8x25G NIC 2x2200W picture

H261-Z61 2U 24SFF AMD Server 8x EPYC 7551 256-Cores 256GB RAM 8x25G NIC 2x2200W

$2512.18



CSE-118 Supermicro 1U 3x GPU Server  2.1Ghz 16-C 128GB CX353A 2x1600W PSU Rails picture

CSE-118 Supermicro 1U 3x GPU Server 2.1Ghz 16-C 128GB CX353A 2x1600W PSU Rails

$450.03



R281-3C2 2U 12 Bay GPU Server 2.2Ghz 20-C 64GB 2x10G SFP+ 2x1200W TrueNAS ZFS picture

R281-3C2 2U 12 Bay GPU Server 2.2Ghz 20-C 64GB 2x10G SFP+ 2x1200W TrueNAS ZFS

$1180.24



CSE-118 Supermicro 1U GPU Server 2.6Ghz 20-C 256GB 2x Nvidia K40 GPU 2x1600W PSU picture

CSE-118 Supermicro 1U GPU Server 2.6Ghz 20-C 256GB 2x Nvidia K40 GPU 2x1600W PSU

$674.03



Dell PowerEdge R720XD Xeon E5-2680 V2 2.8GHz 20 Cores 256GB RAM 12x4TB picture

Dell PowerEdge R720XD Xeon E5-2680 V2 2.8GHz 20 Cores 256GB RAM 12x4TB

$510.00



DELL PowerEdge R730 Server 2x E5-2690v3 2.6GHz =24 Cores 32GB H730 4xRJ45 picture

DELL PowerEdge R730 Server 2x E5-2690v3 2.6GHz =24 Cores 32GB H730 4xRJ45

$275.00



Dell PowerEdge R730XD 28 Core Server 2X Xeon E5-2680 V4 H730 128GB RAM No HDD picture

Dell PowerEdge R730XD 28 Core Server 2X Xeon E5-2680 V4 H730 128GB RAM No HDD

$389.99



Dell PowerEdge R620 Server 2x Xeon  E5-2620 @ 2.0GHz 64GB RAM NO HDDs picture

Dell PowerEdge R620 Server 2x Xeon E5-2620 @ 2.0GHz 64GB RAM NO HDDs

$108.96



Dell PowerEdge R430 3.5 1U 2x E5-2690 v3 2.6ghz 24-Cores 256gb 4x Trays 2x 550w picture

Dell PowerEdge R430 3.5 1U 2x E5-2690 v3 2.6ghz 24-Cores 256gb 4x Trays 2x 550w

$289.99



HP ProLiant DL380 Gen9 16SFF 2x E5-2680v4 2.4GHz =28 Cores 64GB P840 4xRJ45 picture

HP ProLiant DL380 Gen9 16SFF 2x E5-2680v4 2.4GHz =28 Cores 64GB P840 4xRJ45

$355.00