New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Shellshock vulnerability #24

Open

uniqdom opened this issue Nov 24, 2016 · 1 comment

uniqdom commented Nov 24, 2016

The app Shellshock Vulnerability Scan says that Busybox 1.25.1 (downloaded from F-Droid) is vulnerable to Shellshock.

Bash Version? GNU bash, version 4.3.42(1)-release (arm-android-eabi)

Screenshot: https://s21.postimg.org/m0cfqkh9j/Screenshot_20161124_101433.png

More info about the vulnerability: http://blog.indiandragon.in/2014/10/shellshock-vulnerability-in-android.html

Shellshock Vulnerability Scan can be found here:
https://f-droid.org/repository/browse/?fdid=in.indiandragon.shellshock.shellshockvulnerabilityscan&fdpage=52

The code of the app can be found here:https://github.com/indiandragon/Shellshock-Vulnerability-Scan

Author

uniqdom commented Dec 6, 2016

I have done a fresh install of Cyanogenmod 13 and it is vulnerable to Shellshock before installing Busybox. Sorry for the problem.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment