Everything you need to know about the Shellshock Bash bug

#1

Post by sjcsjc » Thu, Sep 25, 2014, 12:21 PM UTC

Everything you need to know about the Shellshock Bash bug
troyhunt.com

Re: Everything you need to know about the Shellshock Bash bug

#2

Post by jamroom » Thu, Sep 25, 2014, 12:51 PM UTC

From the article:

"Of course one means of mitigating this particular attack vector is simply to disable any CGI functionality that makes calls to a shell"

If you're on Ubuntu:

    a2dismod cgi
    service apache2 restart

If you're NOT running any CGI scripts this will disable CGI support in Apache. Not sure if that takes care of things 100%, but might be helpful.

Re: Everything you need to know about the Shellshock Bash bug

#3

Post by aembleton » Thu, Sep 25, 2014, 12:51 PM UTC

Excellent, a comprehensive write up on the issue. Exactly what I was looking for.

Re: Everything you need to know about the Shellshock Bash bug

#4

Post by donatj » Thu, Sep 25, 2014, 12:57 PM UTC

So trying to understand the issue here, is this actually a bash thing or a problem with the web server forwarding commands to bash? I don't understand why bash would be listening to network traffic on its own.

Re: Everything you need to know about the Shellshock Bash bug

#5

Post by rainforest » Thu, Sep 25, 2014, 1:02 PM UTC

donatj wrote: post #4

So trying to understand the issue here, is this actually a bash thing or a problem with the web server forwarding commands to bash? I don't understand why bash would be listening to network traffic on its own.

The latter. Some daemons, like CGI scripts will spawn a shell populated with environment variables from the client. With a vulnerable bash, commands in these get executed.

Re: Everything you need to know about the Shellshock Bash bug

#6

Post by [deleted] » Thu, Sep 25, 2014, 1:03 PM UTC

donatj wrote: post #4

So trying to understand the issue here, is this actually a bash thing or a problem with the web server forwarding commands to bash? I don't understand why bash would be listening to network traffic on its own.

[deleted]

Re: Everything you need to know about the Shellshock Bash bug

#7

Post by therealmarv » Thu, Sep 25, 2014, 1:05 PM UTC

Does anybody has steps what to do really as a sysadmin? Do I only need to install newest bash (on Linux systems) or do I also need to restart daemons like nginx/apache etc. ?

Re: Everything you need to know about the Shellshock Bash bug

#8

Post by fiedzia » Thu, Sep 25, 2014, 1:07 PM UTC

donatj wrote: post #4

So trying to understand the issue here, is this actually a bash thing or a problem with the web server forwarding commands to bash? I don't understand why bash would be listening to network traffic on its own.

Its a bash thing, or more specifically, the issue is with the fact that many (mostly old) web applications/web servers pass content from user straight to bash as environment variables, not expecting this to cause any problems.

Re: Everything you need to know about the Shellshock Bash bug

#9

Post by philh » Thu, Sep 25, 2014, 1:10 PM UTC

Skimming this post, it appears to only reference CVE-2014-6271 and not CVE-2014-7169, so probably not 'everything you need to know'.

(Searching for '=>' doesn't show anything, which I would expect it to if -7169 was mentioned.)

Re: Everything you need to know about the Shellshock Bash bug

#10

Post by billadoid » Thu, Sep 25, 2014, 1:10 PM UTC

jamroom wrote: post #2

From the article: "Of course one means of mitigating this particular attack vector is simply to disable any CGI functionality that makes calls to a shell" If you're on Ubuntu: a2dismod cgi service apache2 restart If you're NOT running any CGI scripts this will disable CGI support in Apache. Not sure if that takes care of things 100%, but might be helpful.

If you're on Ubuntu or Debian your CGI scripts will probably use dash, not bash.