CVE-2014-6271 쉘쇼크 Bash 취약점 조치

CentOS 5 + bash 3.2, CentOS 6 + bash 4.1.2, CentOS 7 + bash 4.2.45에서 테스트하였습니다.

1 개요[편집]

shellshock
[CVE-2014-6271] GNU Bash 원격코드 인젝션 취약점 확인 및 조치
2014년 9월 Bourne Again Shell(Bash) 취약점 보안 업데이트
쉘쇼크, 셸쇼크, 쉘쇼크 해결방법, 조치방법
  • CentOS 6: bash-4.1.2-15.el6_4.x86_64 → bash-4.1.2-15.el6_5.2.x86_64
  • CentOS 7: bash-4.2.45-5.el7.x86_64 → bash-4.2.45-5.el7_0.4.x86_64

2 확인방법[편집]

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
(for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
echo "CVE-2014-7187 vulnerable, word_lineno"

3 확인 1 (취약)[편집]

[root@zetawiki ~]# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
echo vulnerable이 수행되었으므로 취약함
[root@zetawiki ~]# rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
sh: X: line 1: syntax error near unexpected token `='
sh: X: line 1: `'
sh: error importing function definition for `X'
Sun Feb 15 18:41:31 KST 2015
→ date 명령어가 실행되고 echo 파일이 생성되었으므로 취약함
[root@zetawiki ~]# (for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
> echo "CVE-2014-7187 vulnerable, word_lineno"
bash: line 129: syntax error near `x129'
bash: line 129: `for x129 in ; do :'
CVE-2014-7187 vulnerable, word_lineno
→ echo ... 명령어가 수행되었으므로 취약함

4 Bash 버전 확인[편집]

16px-Crystal_Clear_app_xmag.svg.png Bash 버전 확인 문서를 참고하십시오.
[root@zetawiki ~]# rpm -qa | grep bash
bash-3.2-32.el5
[root@zetawiki ~]# rpm -qa | grep bash
bash-4.1.2-15.el6_4.x86_64

5 Bash 업데이트[편집]

[root@zetawiki ~]# yum update bash
... (생략)
================================================================
 Package    Arch         Version               Repository  Size
================================================================
Updating:
 bash       x86_64       4.1.2-29.el6          base       907 k

Transaction Summary
================================================================
Upgrade       1 Package(s)

Total download size: 907 k
Is this ok [y/N]: y
... (생략)
Updated:
  bash.x86_64 0:4.1.2-29.el6                                    

Complete!

6 확인 2 (안전)[편집]

[root@zetawiki ~]# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
this is a test
[root@zetawiki ~]# rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
date
cat: echo: No such file or directory
[root@zetawiki ~]# (for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
> echo "CVE-2014-7187 vulnerable, word_lineno"

7 같이 보기[편집]

8 참고[편집]

문서 댓글 ({{ doc_comments.length }})
{{ comment.name }} {{ comment.created | snstime }}