CVE-2014-6271 쉘쇼크 Bash 취약점 조치

✔️ CentOS 5, bash 3.2에서 테스트하였습니다.

1 개요

[CVE-2014-6271] GNU Bash 원격코드 인젝션 취약점 확인 및 조치

shellshock

쉘쇼크, 쉘쇼크 조치방법

2 확인 (취약)

명령어

Bash

Copy

env x='() { :;}; echo vulnerable' bash -c "echo hello"
env x='() { return;}; whoami' bash -c "echo hello"
cd /tmp; rm -f /tmp/echo; env 'x=() { (a)=>\' bash -c "echo date"; cat /tmp/echo

실행예시

text

Copy

[root@jmnote ~]# env x='() { :;}; echo vulnerable' bash -c "echo hello"
vulnerable
hello

→ echo vulnerable이 수행되었으므로 취약함

text

Copy

[root@jmnote ~]# env x='() { return;}; id' bash -c "echo hello"
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
Segmentation fault

→ id 명령어가 수행되었으므로 취약함

text

Copy

[root@jmnote ~]# cd /tmp; rm -f /tmp/echo; env 'x=() { (a)=>\' bash -c "echo date"; cat /tmp/echo
bash: x: line 1: syntax error near unexpected token `='
bash: x: line 1: `'
bash: error importing function definition for `x'
Tue Sep 30 01:18:22 KST 2014

→ date 명령어가 실행되고 /tmp/echo 파일이 생성되었으므로 취약함

3 Bash 버전 확인

Bash 버전 확인 문서를 참고하십시오.

bat

Copy

[root@jmnote tmp]# rpm -qa | grep bash
bash-3.2-32.el5

4 Bash 업데이트

bat

Copy

[root@jmnote ~]# yum update bash
... (생략)
===========================================================================================
 Package          Arch               Version                     Repository           Size
===========================================================================================
Updating:
 bash             x86_64             3.2-33.el5_10.4             updates             1.8 M

Transaction Summary
===========================================================================================
Install       0 Package(s)
Upgrade       1 Package(s)

Total download size: 1.8 M
Is this ok [y/N]: y

bat

Copy

... (생략)
Updated:
  bash.x86_64 0:3.2-33.el5_10.4                                                            

Complete!

5 확인 (안전)

text

Copy

[root@jmnote ~]# env x='() { :;}; echo vulnerable' bash -c "echo hello"
hello

text

Copy

[root@jmnote ~]# env x='() { return;}; id' bash -c "echo hello"
hello

text

Copy

[root@jmnote ~]# cd /tmp; rm -f /tmp/echo; env 'x=() { (a)=>\' bash -c "echo date"; cat /tmp/echo
date
cat: /tmp/echo: No such file or directory

6 같이 보기

• Bash 버전 확인

7 참고 자료

• http://hacksum.net/vuln/cve-2014-6271-gnu-bash-원격코드-인젝션-취약점/
• https://en.wikipedia.org/wiki/Shellshock_(software_bug)