I am trying to understand what could be the security concern of CVE-2014-6271 and all the links I see just gives me the below command.   env x='() { :;}; echo vulnerable' bash -c "echo this is a test"   If I get the output as,  vulnerable this is a test   It means, my bash shell is vulnerable.   But in what way it is related to security? In other words, what harm could be done to my system?
68210
There is apparently a vulnerability (CVE-2014-6271) in bash:   I am trying to figure out what is happening, but I'm not entirely sure I understand it. How can the echo be executed as it is in single quotes?  $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" vulnerable this is a test     EDIT 1: A patched system looks like this:  $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' this is a test   EDIT 2: There is a related vulnerability / patch:  which uses a slightly different test:  $ env 'x=() { :;}; echo vulnerable' 'BASH_FUNC_x()=() { :;}; echo vulnerable' bash -c "echo test"   unpatched output:  vulnerable bash: BASH_FUNC_x(): line 0: syntax error near unexpected token `)' bash: BASH_FUNC_x(): line 0: `BASH_FUNC_x() () { :;}; echo vulnerable' bash: error importing function definition for `BASH_FUNC_x' test   partially (early version) patched output:  bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' bash: error importing function definition for `BASH_FUNC_x()' test   patched output up to and including CVE-2014-7169:  bash: warning: x: ignoring function definition attempt bash: error importing function definition for `BASH_FUNC_x' test   EDIT 3: story continues with:
10409
If I do not edit the .bashrc or other config files, the environment variables that I've setted are gone when I logout, or turn off the terminal.   What I'm curious is, where are those 'temporary' env vars saved in?   As I guess, they might be in the memory. That makes sense because they will disappear when the terminal is turned off(equals the terminal I was using is gone from the memory). Am I correct?
3828
This is irritating me. I seen several suggestions (all using different files and syntax) and none of them worked.  How do I set an environment variable for a specific user? I am on debian squeeze. What is the exact syntax I should put in the file to make ABC = "123"?
25759
I have encountered comparisions of variables to string literals multiple times over the years which had one character prefixing the variable and the literal, e.g.  if [ "x$A" = "xtrue" ]; then   in order to check whether $A is "true".  I assume this is done to achieve shell compatibility or to work around a longterm bug, an unintuitive behavior, etc. Nothing obvious comes to mind.  Today I figured I want to know the reason, but my research didn't turn up anything. Or maybe it's just me making something out of a rather frequent exposure to rare occurances.  Is this practice still useful, maybe even best?
8780
This is a  about File Permission and Why 777 is "destructive".   I'm not asking how to fix this problem, as there are a ton of references of that already on Server Fault (reinstall OS). Why does it do anything destructive at all?  If you've ever ran this command you pretty much immediately destroy your operating system. I'm not clear why removing restrictions has any impact on existing processes. For example, if I don't have read access to something and after a quick mistype in the terminal suddenly I now have access well... why does that cause Linux to break?
63741
Concrete issue: The  is at version 1.0.5-1, released in July 2011 according to the .  The recent memory-disclosure vulnerability (, , ) isn't fixed in 1.0.5-1. If I'm not misreading the Ubuntu CVE page, all Ubuntu versions seem to ship a vulnerable nginx.   Is this true?  If so: I thought there was a security team at Canonical that's actively working on issues like this, so I expected to get a security update within a short timeframe (hours or days) through apt-get update. Is this expectation -- that keeping my packages up-to-date is enough to stop my server from having known vulnerabilities -- generally wrong? If so: What should I do to keep it secure? Reading the  wouldn't have helped in this case, as the nginx vulnerability was never posted there.
42231
One of my coworkers has provided me with a Bash syntax that I am unfamiliar with.  My Google foo has failed me on figuring out what it does and why/when I should use it.    The command that he sent me was of this form:  someVariable=something command   Initially, I thought that this was equivalent to the following:   someVariable=something ; command   Or  someVariable=something  command   But this doesn't appear to the be case.  Examples:   [Jan-03 11:26][~]$ # Look at the environment variable BAZ. It is currently empty [Jan-03 11:26][~]$ echo $BAZ  [Jan-03 11:27][~]$ # Try running a command of the same format     [Jan-03 11:27][~]$ BAZ=jake echo $BAZ  [Jan-03 11:27][~]$     [Jan-03 11:27][~]$ # Now, echo BAZ again. It is still empty:     [Jan-03 11:27][~]$ echo $BAZ  [Jan-03 11:27][~]$     [Jan-03 11:28][~]$     [Jan-03 11:28][~]$ # If we add a semi-colon to the command, we get dramatically different results: [Jan-03 11:28][~]$ BAZ=jake ; echo $BAZ jake [Jan-03 11:28][~]$ [Jan-03 11:28][~]$ # And we can see that the variable is actually set: [Jan-03 11:29][~]$ echo $BAZ jake [Jan-03 11:29][~]$   What does this syntax do?  What happens to the variable that has been set?  Why does this work?
21443
Is there any standard that covers the portability of running a command after variable assignment on the same line?  APPLE="cider" echo hi   How portable is something like that? Where will it work and where won't it?   Also: my shell scripts start with #!/bin/sh if that makes any difference.
22461
Any questions relating to status updates, or asking if anything is going to be patched for these vulnerabilities should be closed as duplicates of this question.    are in the news right now and sound pretty severe. I don't see any security updates from Ubuntu that cover these vulnerabilities.  What is Ubuntu doing about these vulnerabilities, and what should Ubuntu users be doing?  These are CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754.
17746
I'm at a library, and all of the computers are Windows based.  I'm sshing into my Ubuntu box somewhere else. The terms of service says "You may not make any changes to system files." However, when I ssh into my Ubuntu box, it might "look" like I'm hacking, since I've had a few people (including I presume the library supervisor) look at my computer funny when I opened a website where the text was a monospaced font and the website background was black. Running Command Prompt will certainly be considered to be hacking if looking at a website was.  If I'm sshing into my box it appears as though I'm "hacking" into the computer. I'd like to somehow do it in a web browser with nice happy looking text, so that it actually represents what I'm doing; I'm not going to hack into the computer, I'm only using a computer somewhere else.
36268
I see I can do  $ [ -w /home/durrantm ] &amp;&amp; echo "writable" writable   or  $ test -w /home/durrantm &amp;&amp; echo "writable" writable   or  $ [[ -w /home/durrantm ]] &amp;&amp; echo "writable" writable   I like using the third syntax. Are they equivalent in all ways and for all negative and edge cases? Are there any differences in portability, e.g. between bash on Ubuntu and on OS X or older/newer bash versions, e.g. before/after 4.0 and do they both expand expressions the same way?
44477
The scenario:  In a bash script, I have to check if a password given by a user is a valid user password.   I.e suppose I have a user A with password PA.. In the script I asked user A to enter his password, So how to check if the string entered is really his password?...
81308
I want to run a command such as this in a bash script:  freebcp &lt;authentication and other parameters&gt; -t "," -r "\r\n"   When run directly on the command line, the command works as expected. But when placed in a variable in a bash script it returns an error such as this:  Msg 20104, Level 3 Unexpected EOF encountered in bcp datafile  Msg 20074, Level 11 Attempt to bulk copy an oversized row to the server  bcp copy in failed   When command is placed in a variable and double quotes are escaped:  cmd="freebcp ${db_name}.dbo.${table_name} in ${p_file} -S ${server_name} -U ${username} -P ${password} -t \",\" -r \"\r\n\" -c" `$cmd`   Note: Putting the following in the script works as expected:  `freebcp ${db_name}.dbo.${table_name} in ${p_file} -S ${server_name} -U ${username} -P ${password} -t "," -r "\r\n" -c`   So I know there's some quoting/escaping/expansion problems but I can't figure out how to fix it.  Note 2: Single quoting -t -r parameters doesn't work either
121312
I'm trying to run the command ssh -o StrictHostKeyChecking=no but I'm a bit lost as to how to run it. I've tried running it from a shell script, but the output was the man page or settings that lists out all the parameters.   I then tried running that command from the shell (Cygwin) itself, but got the same man output. How do I run the command? Do I need to provide credentials or anything?
15751
I saw the following syntax in a bash script:   &gt;$(command) &amp;   I know that the ampersand &amp; at the end makes a command run in the background, but I have never seen it in combination with the dollar sign plus the brackets around the command.  What does it do?
48283
I am taking the Linux Essentials class and was doing well until I hit the scripting chapter. I simply do not understand these concepts.  Wondering if someone can break the following down into ultra simplistic terms or point me to a better reference to learn it. I'm currently using netacad's curriculum.        From the text book (with minor formatting changes):     There are some special variables in addition to the ones you set. You   can pass arguments to your script:  #!/bin/bash echo "Hello $1"       A dollar sign followed by a number N corresponds to the Nth argument   passed to the script. If you call the example above with ./test.sh the   output will be Hello Linux. The $0 variable contains the name of the   script itself.      After a program runs, be it a binary or a script, it returns an exit   code which is an integer between 0 and 255. You can test this through   the $? variable to see if the previous command completed successfully.     I understand how to assign variables and how they work with the $ but the whole issue with $0 and $1 -- I just don't get it.    Any help would be much appreciated.
54667
I just wanted to ask whether there is any command which would work on common shells (bash, dash, kornshell)? It is supposed to check if the line variable contains any part of the path.  if [[ $line =~ "$PWD"$ ]] ;then