regex for shellshock - anything bulletproof yet

[iamtheky]

found this perl command to loop through environment variables looking for those that contain code after function declaration.   anything better? 

 

$ perl -e 'for (keys %ENV) { delete $ENV{$_} if $ENV{$_} =~ /};.+/ }'

 

 

 

at the bottom of this article

http://perltricks.com/article/115/2014/9/26/Shellshock-and-Perl

[czardas]

Good find. I guess we'll see what happens in the coming days.

[iamtheky]

So this isn't a fix, but you can search for evildoers in your apache access.log with the regex

"(?s*_*s*)?s*{|cgi"

It will return a lot of false positives for the cgi, but that's better than false negatives. Just pipe tail -f into grep -E and watch for anything untoward happening.

 

from here:  http://www.reddit.com/r/netsec/comments/2hehgk/cve20147169_bash_fix_incomplete_still_exploitable/

i built a splunk report with it, so far returned a bunch of awk and a few rpm commands that are all false positives.