As someone who just runs an Ubuntu 14.04 desktop machine without any web server should I be concerned? I don't really see how anyone could remotely execute bash on my system.
[deleted]
Bash 'shellshock' bug is wormable
11–20 of 157 posts
Re: Bash 'shellshock' bug is wormable
#12As someone who just runs an Ubuntu 14.04 desktop machine without any web server should I be concerned? I don't really see how anyone could remotely execute bash on my system.
Is it connected to the internet? Then patch it. While you can't think of anything that could remotely execute it, you'd be damn surprised how large the attack surface is for this exploit, and how flexible it is. It's a Big Deal(TM). Everything in a Linux system uses bash (hyperbole, but not too far from the truth), and all it takes is one of those not sanitizing input and it's game over :(
Basically, it may not be as immediately exploitable for desktop systems without a web-server as other bugs have been, but I wouldn't be surprised to see something pop-up in the near future.
Re: Bash 'shellshock' bug is wormable
#13As someone who just runs an Ubuntu 14.04 desktop machine without any web server should I be concerned? I don't really see how anyone could remotely execute bash on my system.
Is it connected to the internet? Then patch it. While you can't think of anything that could remotely execute it, you'd be damn surprised how large the attack surface is for this exploit, and how flexible it is. It's a Big Deal(TM). Everything in a Linux system uses bash (hyperbole, but not too far from the truth), and all it takes is one of those not sanitizing input and it's game over :( Basically, it may not be as…
Yeah, the annoying thing is it sounds like there isn't a full patch yet and new vulnerabilities are being discovered. Just trying to understand if I should shut the machine down until everything is sorted out.
Re: Bash 'shellshock' bug is wormable
#14As someone who just runs an Ubuntu 14.04 desktop machine without any web server should I be concerned? I don't really see how anyone could remotely execute bash on my system.
The ecosystem of linux software that shells out to bash is ridiculous, and coercing an env var is a very light requirement.
Virtually any software that takes input from the internet can be a target, and enumerating the combination of versions and configurations is futile. We all need a working bash patch.
Not running a webserver protects against GET spray-n-pray, but you shouldn't feel safe.
Re: Bash 'shellshock' bug is wormable
#15Honest question: does this mean this vulnerability has been in bash for essentially its entire history and someone only discovered it now?
Seems quite likely that someone would have discovered it sooner, especially since it's so simple to exploit.
Re: Bash 'shellshock' bug is wormable
#16What are the best OS-specific alternatives to bash, which could be linked to /bin/sh until bash fixes are stable?
Re: Bash 'shellshock' bug is wormable
#17Could anyone provide a simplified explanation for what this is and what it means?
This is a completely bonkers, Slammer-level hair-on-fire vulnerability. Remember Heartbleed? This is much worse. If you have a computer with an OS other than Windows or Android, your safest bet is to unplug it from the Internet until the bash developers figure this all out.
And my servers? Is there anything I can do without taking them offline?
Re: Bash 'shellshock' bug is wormable
#18Yep. We're currently basically waiting to see which completes first: a) a patch for bash which actually works gets released and then trickles into the various ways to get it on every machine in the world or b) someone writes ~10 lines of payload code (download rootkit, execute, connect to IRC channel, join botnet, etc) and then just hits everything in IP4 space with a for loop. Optionally, the for loop gets distribut…
I run no Linux/Unix/MacOS/compatible/etc machine which connects other machines
How about "I don't run bash"? There are other perfectly good shells, you know...
Re: Bash 'shellshock' bug is wormable
#19What are the best OS-specific alternatives to bash, which could be linked to /bin/sh until bash fixes are stable?
On FreeBSD, /bin/sh is a good alternative to bash.
Re: Bash 'shellshock' bug is wormable
#20Could anyone provide a simplified explanation for what this is and what it means?
This is a completely bonkers, Slammer-level hair-on-fire vulnerability. Remember Heartbleed? This is much worse. If you have a computer with an OS other than Windows or Android, your safest bet is to unplug it from the Internet until the bash developers figure this all out.
[deleted]