{"id":8836,"date":"2015-11-09T16:16:18","date_gmt":"2015-11-09T14:16:18","guid":{"rendered":"http:\/\/blog.natro.com\/?p=8836"},"modified":"2022-03-25T10:42:47","modified_gmt":"2022-03-25T07:42:47","slug":"linux-yapisinda-shellshock-acigi","status":"publish","type":"post","link":"https:\/\/www.natro.com\/blog\/linux-yapisinda-shellshock-acigi\/","title":{"rendered":"Linux Yap\u0131s\u0131nda ShellShock A\u00e7\u0131\u011f\u0131"},"content":{"rendered":"

Bili\u015fim sekt\u00f6r\u00fcnde olupta Akamai firmas\u0131n\u0131 duymayan yoktur. Konumuza ba\u015flamadan \u00f6nce hem genel k\u00fclt\u00fcr\u00fcm\u00fcz\u00fc hem de bilgimizi tazelemek ad\u0131na Akamai firmas\u0131 internetin h\u0131zl\u0131 ve efektif kullan\u0131m\u0131n\u0131 sa\u011flamaya \u00e7al\u0131\u015fan \u015firketlerden birisi oldu\u011funu ayr\u0131ca bir \u00e7ok ulusta faliyetlerini s\u00fcrd\u00fcrd\u00fc\u011f\u00fcn\u00fc payla\u015fmam\u0131z faydal\u0131 olacak.<\/span><\/p>\n

G\u00fcn\u00fcm\u00fczde Facebook gibi b\u00fcy\u00fck bir kurulu\u015funda i\u00e7erik teslim hizmetini sunan Akamai firmas\u0131nda g\u00f6revli g\u00fcvenlik uzman\u0131 Stephane Chazelas ciddi oranda etki yaratabilece\u011fini d\u00fc\u015f\u00fcnd\u00fc\u011f\u00fc Linux<\/strong> a\u00e7\u0131\u011f\u0131n\u0131 tespit etti\u011fini duyurdu.\u00a0Duyurusunu yapm\u0131\u015f oldu\u011fu Shellshock<\/strong> denilen bu a\u00e7\u0131k Linux<\/strong> ve OSX<\/strong>\u00a0platformlar\u0131nda etkili olabilmekte ve bu platformlarda \u201cbash shell<\/strong>\u201d ad\u0131 verilen komut dizilerinin \u00e7al\u0131\u015fmas\u0131na ortam haz\u0131rlayabilmektedir.<\/span><\/p>\n

\u015eimdi Shellshock i\u00e7in detayl\u0131 bir bilgi payla\u015fal\u0131m.<\/strong><\/span><\/p>\n

Shellshock<\/strong> kullan\u0131c\u0131 komutlar\u0131n\u0131n yaz\u0131lmas\u0131na ve uygulanmas\u0131na olanak sa\u011flayan ve temal bir bilgisayar program\u0131 olan \u201cbash<\/strong>\u201d yap\u0131s\u0131ndaki 25 y\u0131l\u0131n a\u015fm\u0131\u015f art\u0131k ya\u015flanmaya y\u00fcz tutmu\u015f bir hatad\u0131r.<\/span><\/p>\n

\u00dcst d\u00fczey yap\u0131lar taraf\u0131ndan Shellshock<\/strong>, geni\u015f \u00e7apta etkiler yaratabilecek taze bir g\u00fcvenlik a\u00e7\u0131\u011f\u0131d\u0131r ve bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131<\/strong> g\u00fcn\u00fcm\u00fczde sosyal ve i\u015f hayat\u0131m\u0131z\u0131n i\u00e7inde bulunan bir \u00e7ok \u00e7ihaz\u0131 etkileyebilece\u011fi bilgisi payla\u015f\u0131lm\u0131\u015ft\u0131r.\u00a0<\/span><\/p>\n

Konuya sekt\u00f6r bazl\u0131 bir yakla\u015f\u0131mda bulundu\u011fumuzdan dolay\u0131 \u00f6ncelikle sunucular\u0131m\u0131zda bu tarz bir a\u00e7\u0131\u011f\u0131n olup olmad\u0131\u011f\u0131n\u0131 kontrol etmemiz olduk\u00e7a faydal\u0131 olacak.<\/strong><\/span><\/p>\n

\u00a0\u2013 Sunucumuza SSH \u00fczerinden ba\u011flanal\u0131m ve a\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131ral\u0131m.<\/span><\/p>\n\n\n\n
env x='() { :;}; echo Sunucunuzda\u2019 bash -c \u201cecho A\u00e7\u0131k var\u201d<\/strong><\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

E\u011fer bu g\u00fcvenlik a\u00e7\u0131\u011f\u0131 sunucunuzda mevcutsa ekran \u00e7\u0131kt\u0131s\u0131 a\u015fa\u011f\u0131daki gibi olacakt\u0131r.<\/span><\/p>\n

Sunucunuzda\u00a0A\u00e7\u0131k var<\/strong><\/span><\/p>\n

Sunucunuzda g\u00fcvenlik a\u00e7\u0131\u011f\u0131 yoksa, ekran \u00e7\u0131kt\u0131s\u0131 a\u015fa\u011f\u0131daki gibi olacakt\u0131r.<\/span><\/p>\n\n\n\n\n
bash: warning: x: ignoring function definition attempt<\/strong><\/span><\/td>\n<\/tr>\n
bash: error importing function definition for `x\u2019<\/strong><\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

A\u00e7\u0131\u011f\u0131 var<\/strong><\/span><\/p>\n

Bu\u00a0denli zarar verebilecek bir a\u00e7\u0131k varsa neler yap\u0131lmas\u0131 gerekir. \u00d6rne\u011fimize en \u00e7ok kullanm\u0131\u015f oldu\u011fum i\u015fletim sistemi olan Centos<\/strong> ile ba\u015flayal\u0131m ve di\u011fer yap\u0131lar hakk\u0131nda da bilgi verelim.<\/span><\/p>\n

( \u00d6NEML\u0130 !!! \u2013 A\u015fa\u011f\u0131da bilginize sunulan i\u015flem ad\u0131mlar\u0131 sadece linux bilgisi iyi olan kullan\u0131lar taraf\u0131ndan ger\u00e7ekle\u015ftirilmelidir.<\/span><\/p>\n

\u00d6ncelikle \u00a0\u201d yum update bash <\/strong>\u201d komutunu kullanarak sunucunu yap\u0131n\u0131zda g\u00fcncelleme ger\u00e7ekle\u015ftirebilrisiniz. Veya da alternatif olarak ;<\/span><\/p>\n

\u2013 cat \/etc\/redhat-release<\/strong> komutuyla i\u015fletim sisteminizin versiyonunu \u00f6\u011frenebilir ve \u2013 uname -a<\/strong> komutu ile i\u015fletim sisteminin 32 \/ 64 bit kontrol\u00fcn\u00fc yap\u0131p sizin i\u00e7in uygun olan se\u00e7enekler \u00fczerinden a\u015fa\u011f\u0131da bilgisize sunmu\u015f oldu\u011fum paketlerin y\u00fcklemesini ger\u00e7ekle\u015ftirebilirsiniz.<\/span><\/p>\n

Centos 6 64 BIT<\/strong><\/span><\/p>\n\n\n\n
rpm -Uvh [url]http:\/\/mirror.centos.org\/centos-5\/5.10\/updates\/x86_64\/RPMS\/bash-3.2-33.el5.1.x86_64.rpm<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Centos 5 32 BIT<\/strong><\/span><\/p>\n\n\n\n
rpm -Uvh http:\/\/mirror.centos.org\/centos-5\/5.10\/updates\/i386\/RPMS\/bash-3.2-33.el5.1.i386.rpm<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Centos 5 64 BIT<\/strong><\/span><\/p>\n\n\n\n
rpm -Uvh [url]http:\/\/mirror.centos.org\/centos-5\/5.10\/updates\/x86_64\/RPMS\/bash-3.2-33.el5.1.x86_64.rpm<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Cloud Linux i\u015fletim sistemi i\u00e7in;<\/b><\/span><\/p>\n\n\n\n
yum clean all <\/strong><\/span>

<\/p>\n

yum update bash<\/strong><\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Debian i\u015fletim sistemi i\u00e7in;<\/b><\/span><\/p>\n\n\n\n
apt-get update apt-get install <\/strong><\/span>

<\/p>\n

\u2013only-upgrade bash<\/strong><\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Ubuntu i\u015fletim sistemi i\u00e7in;<\/b><\/span><\/p>\n\n\n\n
sudo apt-get update && sudo apt-get install bash<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Faydal\u0131 olmas\u0131 dile\u011fiyle.<\/span><\/p>\n\n\n

\u0130statistiklere g\u00f6re; crack yaz\u0131l\u0131m, ters proxy, lisanss\u0131z yaz\u0131l\u0131m <\/strong>kullanan web siteleri, di\u011fer web sitelerine k\u0131yasla daha fazla risk alt\u0131ndad\u0131r. Ayr\u0131ca lisanss\u0131z panel <\/strong>kullan\u0131m\u0131 hukuki sonu\u00e7lar do\u011furur. Verilerinizi g\u00fcvenle korumak i\u00e7in orijinal lisansl\u0131 yaz\u0131l\u0131m<\/strong> kullan\u0131n ve hizmet ald\u0131\u011f\u0131n\u0131z firmadan orijinal lisans kulland\u0131klar\u0131na dair mutlaka kan\u0131tlar isteyin.<\/p>\n","protected":false},"excerpt":{"rendered":"Bili\u015fim sekt\u00f6r\u00fcnde olupta Akamai firmas\u0131n\u0131 duymayan yoktur. Konumuza ba\u015flamadan \u00f6nce hem genel k\u00fclt\u00fcr\u00fcm\u00fcz\u00fc hem de bilgimizi tazelemek ad\u0131na…\n","protected":false},"author":7,"featured_media":27515,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[28,36],"tags":[],"class_list":{"0":"post-8836","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-nasil-yapilir","8":"category-sunucu"},"_links":{"self":[{"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/posts\/8836","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/comments?post=8836"}],"version-history":[{"count":2,"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/posts\/8836\/revisions"}],"predecessor-version":[{"id":33091,"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/posts\/8836\/revisions\/33091"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/media\/27515"}],"wp:attachment":[{"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/media?parent=8836"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/categories?post=8836"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.natro.com\/blog\/wp-json\/wp\/v2\/tags?post=8836"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}