Bash 'shellshock' bug is wormable
blog.erratasec.com
Bash 'shellshock' bug is wormable
1–10 of 157 posts
Re: Bash 'shellshock' bug is wormable
#2Yep. We're currently basically waiting to see which completes first: a) a patch for bash which actually works gets released and then trickles into the various ways to get it on every machine in the world or b) someone writes ~10 lines of payload code (download rootkit, execute, connect to IRC channel, join botnet, etc) and then just hits everything in IP4 space with a for loop. Optionally, the for loop gets distributed to new nodes joining the bot net.
If you cannot say "I run no Linux/Unix/MacOS/compatible/etc machine which connects other machines" you should be at battle stations right now. We're all racing against a for loop and the for loop will probably have a head start.
Re: Bash 'shellshock' bug is wormable
#3I didn't realize iOS and OS X DHCP could be vulnerable. This just went from "Man a lot of other people should be worried about this" to "shit, shit, shit, shit, shit", since I don't run a web server.
Re: Bash 'shellshock' bug is wormable
#4From one of the comments:
> The question isn't whether a CGI is written in bash, but if it calls out to bash no matter how indirectly. Lots of things use the system() libc function, so if /bin/sh is bash it's game over.
Is this true? Which systems are vulnerable to this by default?
Re: Bash 'shellshock' bug is wormable
#5Could anyone provide a simplified explanation for what this is and what it means?
Re: Bash 'shellshock' bug is wormable
#6From one of the comments: > The question isn't whether a CGI is written in bash, but if it calls out to bash no matter how indirectly. Lots of things use the system() libc function, so if /bin/sh is bash it's game over. Is this true? Which systems are vulnerable to this by default?
I think you need that + the ability to add anything to an environment variable. Not sure how easy that is.
edit: reading this looks like its exploiting CGI scripts, presumeably through the host header
Re: Bash 'shellshock' bug is wormable
#7As someone who just runs an Ubuntu 14.04 desktop machine without any web server should I be concerned? I don't really see how anyone could remotely execute bash on my system.
Re: Bash 'shellshock' bug is wormable
#8As someone who just runs an Ubuntu 14.04 desktop machine without any web server should I be concerned? I don't really see how anyone could remotely execute bash on my system.
It's hard, but not impossible. Apparently your DHCP client passes responses from the DHCP server to bash.
Let's say, for the sake of argument, that your ISP's DHCP server is compromised. A worm could then spread to your system from it.
This is entirely hypothetical, but not impossible.
Re: Bash 'shellshock' bug is wormable
#9As someone who just runs an Ubuntu 14.04 desktop machine without any web server should I be concerned? I don't really see how anyone could remotely execute bash on my system.
It's hard, but not impossible. Apparently your DHCP client passes responses from the DHCP server to bash. Let's say, for the sake of argument, that your ISP's DHCP server is compromised. A worm could then spread to your system from it. This is entirely hypothetical, but not impossible.
Ouch, what a mess. Thanks for the warning.
Re: Bash 'shellshock' bug is wormable
#10Could anyone provide a simplified explanation for what this is and what it means?
This is a completely bonkers, Slammer-level hair-on-fire vulnerability. Remember Heartbleed? This is much worse. If you have a computer with an OS other than Windows or Android, your safest bet is to unplug it from the Internet until the bash developers figure this all out.