Shellshock

Updated: 06/16/2017 by Computer Hope

Shellshock, also known as Bashdoor, is a classification of security vulnerabilities in the bash command-line shell that are the result of a bug in the software. The developers of bash were initially notified of the vulnerabilities in September 2014. Additional vulnerabilities were discovered in the following weeks, after close scrutiny by employees of Google and Red Hat. The danger stems from the way bash handles a user's environment variables, and the fact that bash can be used to execute a new instance of itself.

How To Check If Your System Is Vulnerable

Bash is the default shell in macOS X and most versions of Linux. If your system is up-to-date, the vulnerability should already be patched. You can test if your system is vulnerable by opening a terminal and running the following command:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

If this command returns the text:

bash: warning: x: ignoring function definition attempt

bash: error importing function definition for `x'

this is a test

…then your system is safe. If instead the command returns:

vulnerable

this is a test

…then your system has not yet been patched, and you should update your software immediately.

How To Update Your Software

macOS X:

From the Apple menu in the upper-left corner in your screen, select About This Mac. In the dialog box that appears, select Software Update. The system will check to see if you require any updates and guide you through their installation.

Alternatively, you can visit Apple's website at https://support.apple.com/en-us/HT201393 to manually download a patch for the vulnerability.

Ubuntu, Debian, and other Linux variants that use APT:

On Linux distributions that use the APT package manager such as Ubuntu and Debian, you can update bash using your APT package manager by running the following command:

sudo apt-get update && sudo apt-get install --only-upgrade bash

Running this command updates your package database with the most up-to-date information, and then install the newest version of bash.

CentOS Linux:

If you are using CentOS, you can update your bash installation using the yum package manager:

sudo yum update bash

Fedora:

On Fedora systems, the yum command is slightly different. Use this command to update bash:

sudo yum -y install bash

Arch Linux:

Under Arch Linux, you can use the pacman package manager to update bash with this command:

sudo pacman -Syu

Other Operating Systems:

If you are using another operating system, your update method will vary. We recommend that you check your operating system's website for precise instructions and update your system as soon as possible.

Security terms