So if your server is set up with limited permissions for the apache-user, are you still at risk?
I don't think the apache-user if properly restricted can write to directories, or even read most of the system files?
Everything you need to know about the Shellshock Bash bug
81–90 of 296 posts
Re: Everything you need to know about the Shellshock Bash bug
#82Earlier quoted context omitted.
cPanel is probably the most popular reseller hosting software for shared web hosting and it relies on CGI in all kinds of places. That alone provides a huge amount of exploitable hosts - I tried to Shodan it (port 2082) but it seems down right now. Since cPanel is designed for people without system administration experience, it's unlikely they will be patched in a timely manner too. All the CGI scripts are in known s…
cPanel uses CentOS and does system upgrades ala yum update. Dunno if that is on by default or not though. But you aren't going to get into its cgi interface without login so that would have to be cracked first.
Hmm, it's been a while since I last touched cPanel (almost 10 years), but I recall it automatically included aliases for cgi scripts into each vhost.
Try /cgi-sys/guestbook.cgi on any cPanel website for example (a random Google example: https://www.vidahost.com/cgi-sys/guestbook.cgi)
Re: Everything you need to know about the Shellshock Bash bug
#83From the article: "Of course one means of mitigating this particular attack vector is simply to disable any CGI functionality that makes calls to a shell" If you're on Ubuntu: a2dismod cgi service apache2 restart If you're NOT running any CGI scripts this will disable CGI support in Apache. Not sure if that takes care of things 100%, but might be helpful.
If you're on Ubuntu or Debian your CGI scripts will probably use dash, not bash.
I've just our few Apache 2 systems that are Internet facing. Some of the site configs did have the standard Ubuntu CGI stanzas in them. However, the `/usr/lib/cgi-bin` directories were empty.
All this has made me a bit nervous though. I certainly didn't change the system to use bash instead of dash.
Re: Everything you need to know about the Shellshock Bash bug
#84Earlier quoted context omitted.
I'm going to bring it up internally, but don't hold your breath.
Thanks! EDIT after OP's edit. Sad. This situation feels kind of a disaster-relief thing; not a good time to think about monetizing it. Still, I do understand you don't want people thinking you'll always be protecting them from everything even if they don't pay. EDIT2 after clarification downthread, previous edit is to be disregarded.
It's less about trying to monetize it than about the cost to us of suddenly inspecting every request that goes through us. We service a huge volume of traffic and part of our core value is performance so keeping our processing latency is low as possible is important.
(Note: I removed sentence about CloudFlare pricing from previous comment to avoid any confusion about monetization)
Re: Everything you need to know about the Shellshock Bash bug
#85I see how Apache passes request information through environment variables but I don't see how bash comes into play in typical CGI. Is anyone up for educating me? I see http request -> apache -> env variables -> php What am I missing?
When you use any functions in PHP to spawn another process (with the exception of pcntl_fork), PHP will execute a shell to run your process. That shell is then inheriting the parent environment.
If you (or any libraries you use) do not shell out or if you're using php_fpm (which clears the env and passes headers out of the environment), the. You are safe.
Re: Everything you need to know about the Shellshock Bash bug
#86Is anyone able to get the echo test to pass after updating AWS bash?
I updated a handful of machines running an Amazon Linux AMI this morning and they passed the standard echo test after sudo yum update
Re: Everything you need to know about the Shellshock Bash bug
#87I see how Apache passes request information through environment variables but I don't see how bash comes into play in typical CGI. Is anyone up for educating me? I see http request -> apache -> env variables -> php What am I missing?
I think I have the same question.. why is this called a "bash" bug? Is it not a webserver bug? Why does the webserver send data to bash through environment variables? Is there no better way to do it?
That's how Unix works. Subprocesses by default inherit the parents environment. And the http headers end up there because the CGI spec says so
Re: Everything you need to know about the Shellshock Bash bug
#88In another thread, I saw that this was an easy check to see if your bash was affected: env X="() { :;} ; echo busted" /bin/sh -c "echo stuff" If you get "busted" back, then you're affected...which is what I get with Mac OS X 10.9...however, when I try it on an Ubuntu server (14.x) that hasn't been patched in awhile...I don't get the error...Er, why is that? I thought this pretty much affected every bash since 25 year…
AFAIK bash is the default terminal shell in all Ubuntus. So yeah, you're affected.
Re: Everything you need to know about the Shellshock Bash bug
#89I see how Apache passes request information through environment variables but I don't see how bash comes into play in typical CGI. Is anyone up for educating me? I see http request -> apache -> env variables -> php What am I missing?
I think I have the same question.. why is this called a "bash" bug? Is it not a webserver bug? Why does the webserver send data to bash through environment variables? Is there no better way to do it?
CGI is an interface first defined 1993, 21 years ago. No one thought setting user data in environment variables was a risky thing at the time.
More modern interfaces between dynamic code and webservers, like even FastCGI or SCGI or dozens of others do not pass user data over Environment variables, and instead pass data in various protocols over a socket.
Re: Everything you need to know about the Shellshock Bash bug
#90I see how Apache passes request information through environment variables but I don't see how bash comes into play in typical CGI. Is anyone up for educating me? I see http request -> apache -> env variables -> php What am I missing?
I think I have the same question.. why is this called a "bash" bug? Is it not a webserver bug? Why does the webserver send data to bash through environment variables? Is there no better way to do it?
If something, it's a bug in the CGI specification, since passing HTTP headers as environment variables is part of the standard.