tyler.durden/lynis
1
0
Fork 0
mirror of https://github.com/CISOfy/lynis.git synced 2025-07-07 05:54:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

Minor improvements to Shellshock test

Browse Source
This commit is contained in:
mboelen 2014-11-04 01:34:14 +01:00
parent 5439083b4e
commit 525c430d84
1 changed files with 112 additions and 110 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
include/tests_shells
View File

@ -209,8 +209,8 @@
################################################################################# #################################################################################
# #
# Test : SHLL-6290 # Test : SHLL-6290
# Description : Check shellshock vulnerability # Description : Check for Shellshock vulnerability
Register --test-no SHLL-6290 --weight H --network NO --description "Check shellshock vulnerability (CVE-2014-6271)" Register --test-no SHLL-6290 --weight H --network NO --description "Perform Shellshock vulnerability tests"
if [ ${SKIPTEST} -eq 0 ]; then if [ ${SKIPTEST} -eq 0 ]; then
FOUND=0 FOUND=0
#Display --indent 2 --text "- Testing for Shellshock vulnerability" #Display --indent 2 --text "- Testing for Shellshock vulnerability"
@ -224,9 +224,9 @@
fi fi
logtext "Result: command revealed ${FIND} as output" logtext "Result: command revealed ${FIND} as output"
if [ ! "${FIND}" = "" -a -x ${FIND} -a ! -L ${FIND} ]; then if [ ! "${FIND}" = "" ]; then
if [ -x "${FIND}" -a ! -L "${FIND}" ]; then
logtext "Result: found ${FIND} as a valid shell" logtext "Result: found ${FIND} as a valid shell"
SHELLSHOCK_TMP=`mktemp /tmp/lynis-shellshock-test.XXXXXXXXXX` || exit 1 SHELLSHOCK_TMP=`mktemp /tmp/lynis-shellshock-test.XXXXXXXXXX` || exit 1
# CVE-2014-6271 # CVE-2014-6271
@ -334,7 +334,9 @@
logtext "Result: Not vulnerable to exploit #3 on shellshocker.net (no CVE)" logtext "Result: Not vulnerable to exploit #3 on shellshocker.net (no CVE)"
#Display --indent 4 --text "- Exploit#3 on shellshocker.net (no CVE)" --result "OK" --color GREEN #Display --indent 4 --text "- Exploit#3 on shellshocker.net (no CVE)" --result "OK" --color GREEN
fi fi
else
logtext "Result: bash binary found, but not executable, or it is symlinked"
fi
else else
logtext "Result: could not find bash to be a valid shell" logtext "Result: could not find bash to be a valid shell"
fi fi
@ -357,4 +359,4 @@ wait_for_keypress
# #
#================================================================================ #================================================================================
# Lynis - Copyright 2007-2014, Michael Boelen - www.rootkit.nl - The Netherlands # Lynis - Copyright 2007-2014, CISOfy & Michael Boelen - http://cisofy.com - The Netherlands