The warnings about the shellshock bash bug are ominous and not unfounded. This is perhaps a greater risk than Heartbleed. Here are the gory details of this bug.
To test your system for this bug run the following command from the shell:
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
if you see the word 'vulnerable' anywhere in the output, like below, you have the bug.
Because bash is such a fundamental part of Linux/Unix and used in so many ways and so prevalent, it wouldn't be that difficult for malicious hackers to use this bug to penetrate a machine and do all kinds of bad things including completely take over the machine. Web sites would the most obvious target of such attacks.
Now how to fix this. New bash versions with the bug patched have become available so users can update bash and be done. But this is not as easy to do for everyone. Some people may have older, obsolete versions of Linux, so they may not find the new patched bash version. They would need to get the source code and the patches, and then build and install it themselves. Yes, I know everyone should be on the latest version of everything, and I am guilty as charged, but let's dispense with the tarring and feathering for now.
Redhat however, in its haste and panic, had released a workaround on this page with a small block of C code that once installed, would disable function definitions and therefore mitigate this risk. They called it dangerous because one must assume this workaround would disable a legitimate feature of bash and possibly cause system failure if it were being used. Unfortunately a while later this workaround vanished (Update: actually here is the Redhat page for LD_PRELOAD mitigation. I don't know,  maybe the page never vanished at all. Just use the steps on that page then), but not before I had availed myself to it. For me, the ease and speed of its deployment made it worthy of a try. And here are the steps.
1- Put the following C code in a new file, bash_ld_preload.c.
#include <sys/types.h>
#include <stdlib.h>
#include <string.h>
static void __attribute__ ((constructor)) strip_env(void);
extern char **environ;
static void strip_env() {
char *p,*c;
int i = 0;
for (p = environ[i]; p!=NULL;i++ ) {
c = strstr(p,"=() {");
if (c != NULL) {
*(c+2) = '\0';
}
p = environ[i];
}
}
2- Compile bash_ld_preload.c to get bash_ld_preload.so using the following command.
$ gcc bash_ld_preload.c -fPIC -shared -Wl,-soname,bash_ld_preload.so.1 -o bash_ld_preload.so
3- copy bash_ld_preload.so to the /lib/ directory like so:
$ cp bash_ld_preload.so /lib/
4- Add the following to the file /etc/ld.so.preload on a line by itself:
/lib/bash_ld_preload.so
5- Restart all relevant services or just reboot the system to be sure.
There you have it. I deployed this on several machines that run various applications. It killed the bug and there were no adverse effects. That means that those machines were not using the function definition feature of bash. Of course at some point we may write code or install applications that need to use this feature and if we have forgotten about this workaround, there will be a lot of head-scratching.
So, use the above workaround at your own risk. It will probably work for you, but the best approach as always is to update your platform and of course your version of bash.
Give a few Sats