title: Shellshock update link: https://onemoretech.wordpress.com/2014/09/26/shellshock-update/ author: phil2nc description: post_id: 8525 created: 2014/09/26 16:04:35 created_gmt: 2014/09/26 20:04:35 comment_status: closed post_name: shellshock-update status: publish post_type: post

Shellshock update

This post comes a bit late, long after Red Hat and the Fedora Project pushed a new update to close the gap in the original patch that went out Wednesday. If you haven't already done a "yum update", you'll probably want to do that now. Related stuff below. This is for Fedora: Shellshock update: bash packages that resolve CVE-2014-6271 and CVE-2014-7169 available Red Hat Enterprise Linux: Bash specially-crafted environment variables code injection attack (Updated) Also see Red Hat Security's Shellshock FAQ. Red Hat SELinux expert Dan Walsh chimes in on how a properly configured (and enforcing!) SELinux installation could have provided some protection for unpatched systems. A really good, detailed, explanation of how Shellshocker works by Fedora Project lead Matt Miller: Shellshock: How does it actually work? I'm still looking for a detailed, step-by-step howto on deploying and configuring mod_security to meet these kinds of threats, without breaking existing apps. Maybe one will be forthcoming soon (Mitigating the shellshock vulnerability is a good technical resource for those who are already successfully running mod_security, but it might be daunting for anyone deploying the module for the first time during this crisis). Shell based off “Shell” CC-BY 3.0 by Guillaume Kurkdjian http://thenounproject.com/term/shell/40512/

Copyright 2004-2019 Phil Lembo