위키
포럼
도구
바뀐글
랜덤

"CVE-2014-6271 쉘쇼크 Bash 취약점 조치"의 두 판 사이의 차이

잔글 (봇: 자동으로 텍스트 교체 (-source +syntaxhighlight))
 
(사용자 3명의 중간 판 8개는 보이지 않습니다)
10번째 줄: 10번째 줄:


==확인방법==
==확인방법==
<source lang='bash'>
<syntaxhighlight lang='bash'>
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
</source>
</syntaxhighlight>
<source lang='bash'>
<syntaxhighlight lang='bash'>
rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
</source>
</syntaxhighlight>
<source lang='bash'>
<syntaxhighlight lang='bash'>
(for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
(for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
echo "CVE-2014-7187 vulnerable, word_lineno"
echo "CVE-2014-7187 vulnerable, word_lineno"
</source>
</syntaxhighlight>


==확인 1 (취약)==
==확인 1 (취약)==
<source lang='cli'>
<syntaxhighlight lang='console'>
[root@zetawiki ~]# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
[root@zetawiki ~]# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
vulnerable
this is a test
this is a test
</source>
</syntaxhighlight>
:→ <code>echo vulnerable</code>이 수행되었으므로 취약함
:→ <code>echo vulnerable</code>이 수행되었으므로 취약함
<source lang='cli'>
<syntaxhighlight lang='console'>
[root@zetawiki ~]# rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
[root@zetawiki ~]# rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
sh: X: line 1: syntax error near unexpected token `='
sh: X: line 1: syntax error near unexpected token `='
34번째 줄: 34번째 줄:
sh: error importing function definition for `X'
sh: error importing function definition for `X'
Sun Feb 15 18:41:31 KST 2015
Sun Feb 15 18:41:31 KST 2015
</source>
</syntaxhighlight>
:→ date 명령어가 실행되고 echo 파일이 생성되었으므로 취약함
:→ date 명령어가 실행되고 echo 파일이 생성되었으므로 취약함
<source lang='cli'>
<syntaxhighlight lang='console'>
[root@zetawiki ~]# (for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
[root@zetawiki ~]# (for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
> echo "CVE-2014-7187 vulnerable, word_lineno"
> echo "CVE-2014-7187 vulnerable, word_lineno"
42번째 줄: 42번째 줄:
bash: line 129: `for x129 in ; do :'
bash: line 129: `for x129 in ; do :'
CVE-2014-7187 vulnerable, word_lineno
CVE-2014-7187 vulnerable, word_lineno
</source>
</syntaxhighlight>
:→ echo ... 명령어가 수행되었으므로 취약함
:→ echo ... 명령어가 수행되었으므로 취약함


==Bash 버전 확인==
==Bash 버전 확인==
{{참고|Bash 버전 확인}}
{{참고|Bash 버전 확인}}
<source lang='cli'>
<syntaxhighlight lang='console'>
[root@zetawiki ~]# rpm -qa | grep bash
[root@zetawiki ~]# rpm -qa | grep bash
bash-3.2-32.el5  
bash-3.2-32.el5  
</source>
</syntaxhighlight>
<source lang='cli'>
<syntaxhighlight lang='console'>
[root@zetawiki ~]# rpm -qa | grep bash
[root@zetawiki ~]# rpm -qa | grep bash
bash-4.1.2-15.el6_4.x86_64
bash-4.1.2-15.el6_4.x86_64
</source>
</syntaxhighlight>


==Bash 업데이트==
==Bash 업데이트==
<source lang='cli'>
<syntaxhighlight lang='console'>
[root@zetawiki ~]# yum update bash
[root@zetawiki ~]# yum update bash
... (생략)
... (생략)
72번째 줄: 72번째 줄:
Total download size: 907 k
Total download size: 907 k
Is this ok [y/N]: y
Is this ok [y/N]: y
</source>
</syntaxhighlight>
<source lang='cli'>
<syntaxhighlight lang='console'>
... (생략)
... (생략)
Updated:
Updated:
79번째 줄: 79번째 줄:


Complete!
Complete!
</source>
</syntaxhighlight>


==확인 2 (안전)==
==확인 2 (안전)==
<source lang='cli'>
<syntaxhighlight lang='console'>
[root@zetawiki ~]# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
[root@zetawiki ~]# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
this is a test
this is a test
</source>
</syntaxhighlight>
<source lang='cli'>
<syntaxhighlight lang='console'>
[root@zetawiki ~]# rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
[root@zetawiki ~]# rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
date
date
cat: echo: No such file or directory
cat: echo: No such file or directory
</source>
</syntaxhighlight>
<source lang='cli'>
<syntaxhighlight lang='console'>
[root@zetawiki ~]# (for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
[root@zetawiki ~]# (for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
> echo "CVE-2014-7187 vulnerable, word_lineno"
> echo "CVE-2014-7187 vulnerable, word_lineno"
</source>
</syntaxhighlight>


==같이 보기==
==같이 보기==
*[[쉘쇼크]]
*[[Bash 버전 확인]]
*[[Bash 버전 확인]]
*[[하트블리드]]
*[[하트블리드]]
102번째 줄: 103번째 줄:
*[[CVE]]
*[[CVE]]


==참고 자료==
==참고==
*https://en.wikipedia.org/wiki/Shellshock_(software_bug)
*https://en.wikipedia.org/wiki/Shellshock_(software_bug)
*http://hacksum.net/vuln/cve-2014-6271-gnu-bash-원격코드-인젝션-취약점/
*http://hacksum.net/vuln/cve-2014-6271-gnu-bash-원격코드-인젝션-취약점/
*https://access.redhat.com/ko/node/1215293
*https://access.redhat.com/ko/node/1215293
*[http://boho.or.kr/upload/file/EpF860.pdf GNU Bash 원격명령 실행 취약점 대응방안 권고]《KISA 취약점분석팀》 2014-09-30
 
[[분류: CVE]]
[[분류: Bash]]
[[분류: Bash]]
[[분류: 보안]]
[[분류: Yum 설치]]
[[분류: Yum 설치]]
[[분류: 2014년]]
[[분류: 2014년]]

2020년 11월 2일 (월) 00:55 기준 최신판

1 개요[ | ]

shellshock
[CVE-2014-6271] GNU Bash 원격코드 인젝션 취약점 확인 및 조치
2014년 9월 Bourne Again Shell(Bash) 취약점 보안 업데이트
쉘쇼크, 셸쇼크, 쉘쇼크 해결방법, 조치방법
  • CentOS 6: bash-4.1.2-15.el6_4.x86_64 → bash-4.1.2-15.el6_5.2.x86_64
  • CentOS 7: bash-4.2.45-5.el7.x86_64 → bash-4.2.45-5.el7_0.4.x86_64

2 확인방법[ | ]

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo

(for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
echo "CVE-2014-7187 vulnerable, word_lineno"

3 확인 1 (취약)[ | ]

[root@zetawiki ~]# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
→ echo vulnerable이 수행되었으므로 취약함
[root@zetawiki ~]# rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
sh: X: line 1: syntax error near unexpected token `='
sh: X: line 1: `'
sh: error importing function definition for `X'
Sun Feb 15 18:41:31 KST 2015
→ date 명령어가 실행되고 echo 파일이 생성되었으므로 취약함
[root@zetawiki ~]# (for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
> echo "CVE-2014-7187 vulnerable, word_lineno"
bash: line 129: syntax error near `x129'
bash: line 129: `for x129 in ; do :'
CVE-2014-7187 vulnerable, word_lineno
→ echo ... 명령어가 수행되었으므로 취약함

4 Bash 버전 확인[ | ]

Bash 버전 확인 문서를 참고하십시오.
[root@zetawiki ~]# rpm -qa | grep bash
bash-3.2-32.el5

[root@zetawiki ~]# rpm -qa | grep bash
bash-4.1.2-15.el6_4.x86_64

5 Bash 업데이트[ | ]

[root@zetawiki ~]# yum update bash
... (생략)
================================================================
 Package    Arch         Version               Repository  Size
================================================================
Updating:
 bash       x86_64       4.1.2-29.el6          base       907 k

Transaction Summary
================================================================
Upgrade       1 Package(s)

Total download size: 907 k
Is this ok [y/N]: y

... (생략)
Updated:
  bash.x86_64 0:4.1.2-29.el6                                    

Complete!

6 확인 2 (안전)[ | ]

[root@zetawiki ~]# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
this is a test

[root@zetawiki ~]# rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
date
cat: echo: No such file or directory

[root@zetawiki ~]# (for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
> echo "CVE-2014-7187 vulnerable, word_lineno"

7 같이 보기[ | ]

8 참고[ | ]

원본 주소 "https://zetawiki.com/w/index.php?title=CVE-2014-6271_쉘쇼크_Bash_취약점_조치&oldid=604602"
문서 댓글 ({{ doc_comments.length }})
{{ comment.name }} {{ comment.created | snstime }}