Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2014-6271: Remote code execution through bash

seclists.org

Post reply on HN
Print view View original

11–20 of 432 posts

Re: CVE-2014-6271: Remote code execution through bash

#11

Post by lonnyk »

drzaiusapelord wrote: post #9
Oculus wrote: post #4

Have big security vulnerabilities been cropping up more often recently or does it seem that way because I've started to pay attention?

Its been a bad time for FOSS/Linux systems. Heartbleed, the occasional priv escalation, apt-get, bash, etc. Or whatever the hell happened at TrueCrypt. Or the recent AOSP browser bug in Android that probably won't be patched by any OEM/Carrier. These are all pretty serious issues. Not to mention the endless wave of malware targeting Windows systems, especially the evil cryptolocker ransomware. I really do think heart…

Are you referring to this apt-get vulnerability or another one: https://lists.debian.org/debian-security-announce/2014/msg00... ?

Re: CVE-2014-6271: Remote code execution through bash

#13

Post by dpeck »

Oculus wrote: post #4

Have big security vulnerabilities been cropping up more often recently or does it seem that way because I've started to pay attention?

you're just paying attention. There have been some interesting ones the last year or two but this is really a trickle compared to early through mid 2000s

Re: CVE-2014-6271: Remote code execution through bash

#14

Post by hijinks »

Oculus wrote: post #4

Have big security vulnerabilities been cropping up more often recently or does it seem that way because I've started to pay attention?

http://www.cvedetails.com/browse-by-date.php

Its not like each year is an increase.. but it seems this year has had more major giant remote ones then in the past

Re: CVE-2014-6271: Remote code execution through bash

#15

Post by mmastrac »

masterleep wrote: post #5

env x='() { :;}; echo vulnerable' bash -c "echo this is a test" From https://securityblog.redhat.com/2014/09/24/bash-specially-cr...

Oh damn:

curl -H 'User-Agent: () { :;}; echo; echo vulnerable to CVE-2014-6271'

Tested and working against a shell script CGI.

Re: CVE-2014-6271: Remote code execution through bash

#17

Post by agwa »

It is a very good thing that Debian and Ubuntu use /bin/dash for /bin/sh by default, since /bin/sh is implicitly invoked all over the place (e.g. by system(3)). Distros which use /bin/bash for /bin/sh are gonna have a bad time.

Edit: not implying that Debian and Ubuntu aren't affected too, just that the impact there will be lessened.

Re: CVE-2014-6271: Remote code execution through bash

#19

Post by nknighthb »

Zweihander wrote: post #2

For more info: http://www.csoonline.com/article/2687265/application-securit... This should be fun

CGI has always been an accident waiting to happen, but hardly anybody uses it anymore anyway, and even more rarely in a manner that invokes bash, of all things.

I fail to see how "HTTP requests" generically are a vector, and its "Here is a sample" statement is not a link and is followed by... nothing.

This article tells me nothing useful other than "don't allow untrusted data into your environment", which we've all known for 20 years.

Post reply on HN