위키
포럼
도구
바뀐글
랜덤

"CVE-2014-6271 쉘쇼크 Bash 취약점 조치"의 두 판 사이의 차이

잔글 (봇: 자동으로 텍스트 교체 (-<source +<syntaxhighlight ))
잔글 (봇: 자동으로 텍스트 교체 (-source +syntaxhighlight))
 
(같은 사용자의 중간 판 하나는 보이지 않습니다)
12번째 줄: 12번째 줄:
<syntaxhighlight lang='bash'>
<syntaxhighlight lang='bash'>
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
</source>
</syntaxhighlight>
<syntaxhighlight lang='bash'>
<syntaxhighlight lang='bash'>
rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
</source>
</syntaxhighlight>
<syntaxhighlight lang='bash'>
<syntaxhighlight lang='bash'>
(for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
(for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
echo "CVE-2014-7187 vulnerable, word_lineno"
echo "CVE-2014-7187 vulnerable, word_lineno"
</source>
</syntaxhighlight>


==확인 1 (취약)==
==확인 1 (취약)==
26번째 줄: 26번째 줄:
vulnerable
vulnerable
this is a test
this is a test
</source>
</syntaxhighlight>
:→ <code>echo vulnerable</code>이 수행되었으므로 취약함
:→ <code>echo vulnerable</code>이 수행되었으므로 취약함
<syntaxhighlight lang='console'>
<syntaxhighlight lang='console'>
34번째 줄: 34번째 줄:
sh: error importing function definition for `X'
sh: error importing function definition for `X'
Sun Feb 15 18:41:31 KST 2015
Sun Feb 15 18:41:31 KST 2015
</source>
</syntaxhighlight>
:→ date 명령어가 실행되고 echo 파일이 생성되었으므로 취약함
:→ date 명령어가 실행되고 echo 파일이 생성되었으므로 취약함
<syntaxhighlight lang='console'>
<syntaxhighlight lang='console'>
42번째 줄: 42번째 줄:
bash: line 129: `for x129 in ; do :'
bash: line 129: `for x129 in ; do :'
CVE-2014-7187 vulnerable, word_lineno
CVE-2014-7187 vulnerable, word_lineno
</source>
</syntaxhighlight>
:→ echo ... 명령어가 수행되었으므로 취약함
:→ echo ... 명령어가 수행되었으므로 취약함


50번째 줄: 50번째 줄:
[root@zetawiki ~]# rpm -qa | grep bash
[root@zetawiki ~]# rpm -qa | grep bash
bash-3.2-32.el5  
bash-3.2-32.el5  
</source>
</syntaxhighlight>
<syntaxhighlight lang='console'>
<syntaxhighlight lang='console'>
[root@zetawiki ~]# rpm -qa | grep bash
[root@zetawiki ~]# rpm -qa | grep bash
bash-4.1.2-15.el6_4.x86_64
bash-4.1.2-15.el6_4.x86_64
</source>
</syntaxhighlight>


==Bash 업데이트==
==Bash 업데이트==
72번째 줄: 72번째 줄:
Total download size: 907 k
Total download size: 907 k
Is this ok [y/N]: y
Is this ok [y/N]: y
</source>
</syntaxhighlight>
<syntaxhighlight lang='console'>
<syntaxhighlight lang='console'>
... (생략)
... (생략)
79번째 줄: 79번째 줄:


Complete!
Complete!
</source>
</syntaxhighlight>


==확인 2 (안전)==
==확인 2 (안전)==
85번째 줄: 85번째 줄:
[root@zetawiki ~]# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
[root@zetawiki ~]# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
this is a test
this is a test
</source>
</syntaxhighlight>
<syntaxhighlight lang='console'>
<syntaxhighlight lang='console'>
[root@zetawiki ~]# rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
[root@zetawiki ~]# rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
date
date
cat: echo: No such file or directory
cat: echo: No such file or directory
</source>
</syntaxhighlight>
<syntaxhighlight lang='console'>
<syntaxhighlight lang='console'>
[root@zetawiki ~]# (for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
[root@zetawiki ~]# (for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
> echo "CVE-2014-7187 vulnerable, word_lineno"
> echo "CVE-2014-7187 vulnerable, word_lineno"
</source>
</syntaxhighlight>


==같이 보기==
==같이 보기==

2020년 11월 2일 (월) 00:55 기준 최신판

1 개요[ | ]

shellshock
[CVE-2014-6271] GNU Bash 원격코드 인젝션 취약점 확인 및 조치
2014년 9월 Bourne Again Shell(Bash) 취약점 보안 업데이트
쉘쇼크, 셸쇼크, 쉘쇼크 해결방법, 조치방법
  • CentOS 6: bash-4.1.2-15.el6_4.x86_64 → bash-4.1.2-15.el6_5.2.x86_64
  • CentOS 7: bash-4.2.45-5.el7.x86_64 → bash-4.2.45-5.el7_0.4.x86_64

2 확인방법[ | ]

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo

(for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
echo "CVE-2014-7187 vulnerable, word_lineno"

3 확인 1 (취약)[ | ]

[root@zetawiki ~]# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
→ echo vulnerable이 수행되었으므로 취약함
[root@zetawiki ~]# rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
sh: X: line 1: syntax error near unexpected token `='
sh: X: line 1: `'
sh: error importing function definition for `X'
Sun Feb 15 18:41:31 KST 2015
→ date 명령어가 실행되고 echo 파일이 생성되었으므로 취약함
[root@zetawiki ~]# (for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
> echo "CVE-2014-7187 vulnerable, word_lineno"
bash: line 129: syntax error near `x129'
bash: line 129: `for x129 in ; do :'
CVE-2014-7187 vulnerable, word_lineno
→ echo ... 명령어가 수행되었으므로 취약함

4 Bash 버전 확인[ | ]

Bash 버전 확인 문서를 참고하십시오.
[root@zetawiki ~]# rpm -qa | grep bash
bash-3.2-32.el5

[root@zetawiki ~]# rpm -qa | grep bash
bash-4.1.2-15.el6_4.x86_64

5 Bash 업데이트[ | ]

[root@zetawiki ~]# yum update bash
... (생략)
================================================================
 Package    Arch         Version               Repository  Size
================================================================
Updating:
 bash       x86_64       4.1.2-29.el6          base       907 k

Transaction Summary
================================================================
Upgrade       1 Package(s)

Total download size: 907 k
Is this ok [y/N]: y

... (생략)
Updated:
  bash.x86_64 0:4.1.2-29.el6                                    

Complete!

6 확인 2 (안전)[ | ]

[root@zetawiki ~]# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
this is a test

[root@zetawiki ~]# rm -f echo; env X='() { (a)=>\' sh -c "echo date"; cat echo
date
cat: echo: No such file or directory

[root@zetawiki ~]# (for x in {1..200} ; do echo "for x$x in ; do :"; done; for x in {1..200} ; do echo done ; done) | bash ||
> echo "CVE-2014-7187 vulnerable, word_lineno"

7 같이 보기[ | ]

8 참고[ | ]

원본 주소 "https://zetawiki.com/w/index.php?title=CVE-2014-6271_쉘쇼크_Bash_취약점_조치&oldid=604602"
문서 댓글 ({{ doc_comments.length }})
{{ comment.name }} {{ comment.created | snstime }}