{"id":7899,"date":"2014-09-26T15:39:00","date_gmt":"2014-09-26T15:39:00","guid":{"rendered":"https:\/\/www.heartinternet.uk\/blog\/?p=7899"},"modified":"2014-09-26T15:39:00","modified_gmt":"2014-09-26T15:39:00","slug":"important-shellshock-vulnerability","status":"publish","type":"post","link":"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/","title":{"rendered":"Important: Shellshock vulnerability"},"content":{"rendered":"

By now you’re probably aware that a serious Unix (Linux) vulnerability has been discovered. Named ‘Shellshock’<\/a>, it affects Unix-based operating systems such as Linux and Mac OS X. If exploited, it can be used by hackers to gain remote control of servers and personal computers.<\/p>\n

The aim of this post is to outline the steps we’ve already taken, and provide more details on what (if anything) you need to do.<\/p>\n

\n

What’s affected?<\/h3>\n

This has been reported worldwide by the media and isn’t specific to any particular company, so if you have hosting elsewhere and you’re unsure of the steps your web host or server administrator has taken, it’s vital to find out. You will also need to check any hardware you own running a Unix-based OS (e.g. desktops and laptops), and install recommended updates if they allow external SSH connections.<\/p>\n

All versions of bash up to and including 4.3 are vulnerable.<\/p>\n

All supported Linux distributions are affected and have released patches.<\/p>\n

Debian: https:\/\/www.debian.org\/security\/2014\/dsa-3035<\/a><\/p>\n

Ubuntu: https:\/\/people.canonical.com\/~ubuntu-security\/cve\/2014\/CVE-2014-7169.html<\/a><\/p>\n

Fedora: https:\/\/lists.fedoraproject.org\/pipermail\/package-announce\/2014-September\/138687.html<\/a><\/p>\n

Cent OS: https:\/\/lists.centos.org\/pipermail\/centos-announce\/2014-September\/020593.html <\/a><\/p>\n

More information from Red Hat: https:\/\/access.redhat.com\/articles\/1200223<\/a><\/p>\n

\n

Shared Web Hosting<\/h3>\n

In terms of your web hosting with Heart Internet, we have kept on top of the exploit and security issues since the vulnerability was first highlighted earlier in the week within the Linux community. If you have a shared hosting account with us, you do not need to take any action.<\/p>\n

All Heart Internet infrastructure and shared web hosting servers (Starter Pro, Home Pro, Business Pro and Reseller Pro) were patched on Wednesday as soon as the initial vulnerability CVE-2014-6271 was announced.  All Heart Internet infrastructure and shared web hosting servers were patched this morning (Friday) as soon as updates for CVE-2014-7169 were available.<\/p>\n

Please rest assured that we will be keeping even closer watch on the situation and will implement any further security patches as needed; any updates will be added to the bottom of this blog post.<\/p>\n

\n

VPS, Hybrid Server & Dedicated Servers<\/h3>\n

If you have a VPS, Hybrid Server or Dedicated Server, these are unmanaged by us by default and you will need to update<\/strong> (and if you’re a Reseller, help\/tell your own customers to update) if you haven’t already.<\/p>\n

CentOS & Fedora use bash by default. To update:<\/p>\n

yum -y update bash<\/em><\/p>\n

rpm -q –changelog bash | grep -B1 -A1 CVE-2014-7169<\/em><\/p>\n

This should return something like the following<\/p>\n

* Thu Sep 25 2014 Ondrej Oprala <ooprala@redhat.com> – 4.1.2-15.2<\/p>\n

– CVE-2014-7169<\/p>\n

                                 Resolves: #1146322<\/p>\n

Once you have successfully updated we recommend that you reboot the server to make sure that there are no vulnerable invocations of bash running.<\/p>\n

Ubuntu and Debian may not use bash by default. However, you still need to patch as bash is likely to be installed. To do this:<\/p>\n

apt-get update && apt-get install –only-upgrade bash<\/em><\/p>\n

Following the update, you should reboot the server to make sure that there are no vulnerable invocations of bash running.<\/p>\n

\n

Summary<\/h3>\n

Our security engineers apply patches and fix issues within all third party operating systems and code as needed with our systems and shared platforms. Very few attract media attention like Shellshock (and Heartbleed back in April), but in all cases we treat is as a crucial behind-the-scenes task and apply fixes the instant they become available.<\/p>\n

We pride ourselves on fast action where security is concerned, and this is something we constantly monitor regardless of how small the bug or how much media attention it gets. From a security perspective, we treat all confirmed (and rumoured) vulnerabilities with the same top priority. If you have any questions or concerns, please raise a ticket with our support team and they will be happy to help out where needed.<\/p>\n

Thank you for hosting with us, and I hope this alleviates any concerns you may have.<\/p>\n

(Image credit<\/a>)<\/p>\n","protected":false},"excerpt":{"rendered":"

By now you’re probably aware that a serious Unix (Linux) vulnerability has been discovered. Named ‘Shellshock’, it affects Unix-based operating systems such as Linux and Mac OS X. The aim of this post is to outline the steps we’ve already taken, and provide more details on what (if anything) you need to do.<\/p>\n","protected":false},"author":2,"featured_media":8181,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[],"class_list":{"0":"post-7899","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-misc"},"yoast_head":"\nImportant: Shellshock vulnerability - Heart Internet<\/title>\n<meta name=\"description\" content=\"Important: Shellshock vulnerability - Written by the team at Heart Internet.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Important: Shellshock vulnerability - Heart Internet\" \/>\n<meta property=\"og:description\" content=\"Important: Shellshock vulnerability - Written by the team at Heart Internet.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/\" \/>\n<meta property=\"og:site_name\" content=\"Heart Internet\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/heartinternet\/\" \/>\n<meta property=\"article:published_time\" content=\"2014-09-26T15:39:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2015\/06\/category_heart_internet1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1620\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Eliot Chambers-Ostler\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@heartinternet\" \/>\n<meta name=\"twitter:site\" content=\"@heartinternet\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Eliot Chambers-Ostler\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/\"},\"author\":{\"name\":\"Eliot Chambers-Ostler\",\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/person\/58ed7f27cc0f3ab6e69135742a5eee28\"},\"headline\":\"Important: Shellshock vulnerability\",\"datePublished\":\"2014-09-26T15:39:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/\"},\"wordCount\":718,\"commentCount\":30,\"publisher\":{\"@id\":\"https:\/\/heartblog.victory.digital\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2015\/06\/category_heart_internet1.jpg\",\"articleSection\":[\"Misc\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/\",\"url\":\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/\",\"name\":\"Important: Shellshock vulnerability - Heart Internet\",\"isPartOf\":{\"@id\":\"https:\/\/heartblog.victory.digital\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2015\/06\/category_heart_internet1.jpg\",\"datePublished\":\"2014-09-26T15:39:00+00:00\",\"description\":\"Important: Shellshock vulnerability - Written by the team at Heart Internet.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#primaryimage\",\"url\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2015\/06\/category_heart_internet1.jpg\",\"contentUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2015\/06\/category_heart_internet1.jpg\",\"width\":1620,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.heartinternet.uk\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Important: Shellshock vulnerability\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/heartblog.victory.digital\/#website\",\"url\":\"https:\/\/heartblog.victory.digital\/\",\"name\":\"Heart Internet\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/heartblog.victory.digital\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/heartblog.victory.digital\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/heartblog.victory.digital\/#organization\",\"name\":\"Heart Internet\",\"url\":\"https:\/\/heartblog.victory.digital\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/02\/HeartInternet_Logo_Colour.webp\",\"contentUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/02\/HeartInternet_Logo_Colour.webp\",\"width\":992,\"height\":252,\"caption\":\"Heart Internet\"},\"image\":{\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/heartinternet\/\",\"https:\/\/x.com\/heartinternet\",\"https:\/\/www.linkedin.com\/company\/heart-internet-ltd\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/person\/58ed7f27cc0f3ab6e69135742a5eee28\",\"name\":\"Eliot Chambers-Ostler\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/08\/cropped-Eliot-96x96.jpg\",\"contentUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/08\/cropped-Eliot-96x96.jpg\",\"caption\":\"Eliot Chambers-Ostler\"},\"url\":\"https:\/\/www.heartinternet.uk\/blog\/author\/eliot-chambers-ostler\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Important: Shellshock vulnerability - Heart Internet","description":"Important: Shellshock vulnerability - Written by the team at Heart Internet.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/","og_locale":"en_GB","og_type":"article","og_title":"Important: Shellshock vulnerability - Heart Internet","og_description":"Important: Shellshock vulnerability - Written by the team at Heart Internet.","og_url":"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/","og_site_name":"Heart Internet","article_publisher":"https:\/\/www.facebook.com\/heartinternet\/","article_published_time":"2014-09-26T15:39:00+00:00","og_image":[{"width":1620,"height":720,"url":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2015\/06\/category_heart_internet1.jpg","type":"image\/jpeg"}],"author":"Eliot Chambers-Ostler","twitter_card":"summary_large_image","twitter_creator":"@heartinternet","twitter_site":"@heartinternet","twitter_misc":{"Written by":"Eliot Chambers-Ostler","Estimated reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#article","isPartOf":{"@id":"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/"},"author":{"name":"Eliot Chambers-Ostler","@id":"https:\/\/heartblog.victory.digital\/#\/schema\/person\/58ed7f27cc0f3ab6e69135742a5eee28"},"headline":"Important: Shellshock vulnerability","datePublished":"2014-09-26T15:39:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/"},"wordCount":718,"commentCount":30,"publisher":{"@id":"https:\/\/heartblog.victory.digital\/#organization"},"image":{"@id":"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2015\/06\/category_heart_internet1.jpg","articleSection":["Misc"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/","url":"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/","name":"Important: Shellshock vulnerability - Heart Internet","isPartOf":{"@id":"https:\/\/heartblog.victory.digital\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#primaryimage"},"image":{"@id":"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2015\/06\/category_heart_internet1.jpg","datePublished":"2014-09-26T15:39:00+00:00","description":"Important: Shellshock vulnerability - Written by the team at Heart Internet.","breadcrumb":{"@id":"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#primaryimage","url":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2015\/06\/category_heart_internet1.jpg","contentUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2015\/06\/category_heart_internet1.jpg","width":1620,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/www.heartinternet.uk\/blog\/important-shellshock-vulnerability\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.heartinternet.uk\/blog\/"},{"@type":"ListItem","position":2,"name":"Important: Shellshock vulnerability"}]},{"@type":"WebSite","@id":"https:\/\/heartblog.victory.digital\/#website","url":"https:\/\/heartblog.victory.digital\/","name":"Heart Internet","description":"","publisher":{"@id":"https:\/\/heartblog.victory.digital\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/heartblog.victory.digital\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/heartblog.victory.digital\/#organization","name":"Heart Internet","url":"https:\/\/heartblog.victory.digital\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/heartblog.victory.digital\/#\/schema\/logo\/image\/","url":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/02\/HeartInternet_Logo_Colour.webp","contentUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/02\/HeartInternet_Logo_Colour.webp","width":992,"height":252,"caption":"Heart Internet"},"image":{"@id":"https:\/\/heartblog.victory.digital\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/heartinternet\/","https:\/\/x.com\/heartinternet","https:\/\/www.linkedin.com\/company\/heart-internet-ltd"]},{"@type":"Person","@id":"https:\/\/heartblog.victory.digital\/#\/schema\/person\/58ed7f27cc0f3ab6e69135742a5eee28","name":"Eliot Chambers-Ostler","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/heartblog.victory.digital\/#\/schema\/person\/image\/","url":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/08\/cropped-Eliot-96x96.jpg","contentUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/08\/cropped-Eliot-96x96.jpg","caption":"Eliot Chambers-Ostler"},"url":"https:\/\/www.heartinternet.uk\/blog\/author\/eliot-chambers-ostler\/"}]}},"_links":{"self":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts\/7899","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/comments?post=7899"}],"version-history":[{"count":0,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts\/7899\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/media\/8181"}],"wp:attachment":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/media?parent=7899"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/categories?post=7899"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/tags?post=7899"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}