辉克's Blog

创造机会的人是勇者;等待机会的人是愚者

Linux Bash漏洞修复方法

日前Linux官方内置Bash中新发现一个非常严重安全漏洞,黑客可以利用该Bash漏洞完全控制目标系统并发起攻击,为了避免您Linux服务器受影响,建议您尽快完成漏洞修补,修复方法如下:
漏洞检测方法
可以使用如下命令来检查系统存在此漏洞:
env x='() { :;}; echo vulnerable’ bash -c “echo this is a test”
修复前
输出:
vulnerable
this is a test
使用修补方案修复后
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x
this is a test
特别提示:该修复不会有任何影响,如果您的脚本使用以上方式定义环境变量,修复后您的脚本执行会报错。
建议修补方案
centos:
yum -y update bash
ubuntu:
14.04 64bit
wget?http://mirrors.aliyun.com/fix_stuff/bash_4.3-7ubuntu1.1_amd64.deb?&& dpkg -i bash_4.3-7ubuntu1.1_amd64.deb?
14.04 32bit?
wget?http://mirrors.aliyun.com/fix_stuff/bash_4.3-7ubuntu1.1_i386.deb?&& dpkg -i??bash_4.3-7ubuntu1.1_i386.deb?
12.04 64bit?
wget?http://mirrors.aliyun.com/fix_stuff/bash_4.2-2ubuntu2.2_amd64.deb?&& dpkg -i??bash_4.2-2ubuntu2.2_amd64.deb?
12.04 32bit?
wget?http://mirrors.aliyun.com/fix_stuff/bash_4.2-2ubuntu2.2_i386.deb?&& dpkg -i??bash_4.2-2ubuntu2.2_i386.deb?
10.10 64bit?
wget?http://mirrors.aliyun.com/fix_stuff/bash_4.1-2ubuntu3.1_amd64.deb?&& dpkg -i bash_4.1-2ubuntu3.1_amd64.deb?
10.10 32bit?
wget?http://mirrors.aliyun.com/fix_stuff/bash_4.1-2ubuntu3.1_i386.deb?&& dpkg -i bash_4.1-2ubuntu3.1_i386.deb?
debian:
7.5 64bit && 32bit?
apt-get -y install –only-upgrade bash
6.0.x 64bit?
wget?http://mirrors.aliyun.com/debian/pool/main/b/bash/bash_4.1-3%2bdeb6u1_amd64.deb?&&??dpkg -i bash_4.1-3+deb6u1_amd64.deb?
6.0.x 32bit?
wget?http://mirrors.aliyun.com/debian/pool/main/b/bash/bash_4.1-3%2bdeb6u1_i386.deb?&&??dpkg -i bash_4.1-3+deb6u1_i386.deb?
opensuse:
13.1 64bit?
wget?http://mirrors.aliyun.com/fix_stuff/bash-4.2-68.4.1.x86_64.rpm?&& rpm -Uvh bash-4.2-68.4.1.x86_64.rpm?
13.1 32bit?
wget?http://mirrors.aliyun.com/fix_stuff/bash-4.2-68.4.1.i586.rpm?&& rpm -Uvh bash-4.2-68.4.1.i586.rpm?
aliyun linux:
5.x 64bit?
wget?http://mirrors.aliyun.com/centos/5/updates/x86_64/RPMS/bash-3.2-33.el5.1.x86_64.rpm && rpm -Uvh bash-3.2-33.el5.1.x86_64.rpm
5.x 32bit?
wget?http://mirrors.aliyun.com/centos/5/updates/i386/RPMS/bash-3.2-33.el5.1.i386.rpm && rpm -Uvh bash-3.2-33.el5.1.i386.rpm?

发表回复