[EdY]

Hi folks,

Just wanted to find out if anyone has looked into this?

I use BGShell to get into what looks like a BASH shell command-line prompt on my BlackBerry.... Does this suffer the same vulnerability? I know we are QNX based and with access to the shell being unlikely from a remote attack being possible, or perhaps a Rogue app could access the shell scripting functions and get super-user access.

[EdY]

By the way I tried the test linked on this page:

Bash shell 'Shellshock' flaw opens OS X, Linux, more to attack, called 'bigger than Heartbleed'

How to tell if you're vulnerable


To test if your version of Bash is vulnerable to this issue, Red Hat says to run this command:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

If the system responds with the following, then you're running a vulnerable version of Bash and you should apply any available updates immediately:

vulnerable

this is a test

"The patch used to fix this issue ensures that no code is allowed after the end of a Bash function," Red Hat reports. So rather than spitting out "Vulnerable," a protected version of Bash will spit out the following when you run the aforementioned command:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' this is a test