[deleted]
CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
101–110 of 226 posts
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#102What tools are people using to track and push out security updates, if any? Right now I only have a few servers to administer so apticron is sufficient for notification and upgrading isn't a burden. Also, does anyone have a way to push out patched packages fast? Imagine that a patch is available, or it's trivial to remove a feature that you're not using, but the distribution hasn't made a package yet. I have been dre…
Since I'm an Ubuntu user, I use Landscape to keep my system up-to-date: https://landscape.canonical.com/ It did the patching for me during the night (I told it to do so for security updates), so I woke up to already patched systems. Full disclaimer: I work for Canonical.
I seem to have woken up to a patched system too, i.e.
Start-Date: 2014-09-25 06:53:13
Upgrade: libnss3-1d:amd64 (3.17-0ubuntu0.14.04.1, 3.17.1- 0ubuntu0.14.04.1), libnss3-nssdb:amd64 (3.17-0ubuntu0.14.04.1, 3.17.1-0ubuntu0.14.04.1), bash:amd64 (4.3-7ubuntu1, 4.3-7ubuntu1.1), libnss3:amd64 (3.17-0ubuntu0.14.04.1, 3.17.1-0ubuntu0.14.04.1)
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#103I run an Ubuntu server in my closet as a general-purpose file server and such, mostly just for my own use or for sending files to friends. I have just turned it off and disabled all port forwards to it, and I will wait at least a few days and check for a more definitive fix before opening it back up to the internet. I recommend anyone in a similar situation do the same.
Why? Why don't you uninstall bash all-together? Most programs should be using '/bin/sh' and not bash.(IIRC Linux might have symlink between the two, which is awful) You could install zsh. You could add further security layers, harden your network-level access, monitor your logs and so forth. Security is a set of policies. If you think that there are users who have unauthorized access to your system or you run bash-en…
I don't have the time right now to figure out what the default shell is and whether Ubuntu supports switching it, and whether I have any custom scrips or some such that assume /bin/sh is bash. So the easiest thing to do is just disconnect it for now.
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#104[deleted]
[deleted]
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#105[deleted]
If it's truely unused, you should be using /bin/false instead of /bin/sh. Note that /bin/sh is not always dash in many cases, so just because you are using /bin/sh over /bin/bash doesn't mean you're not vulnerable.
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#106The exploit worked against my cgi perl scripts as well! I had cgi-bin/update.pl running on OS X and I exploited it as mentioned here: https://twitter.com/hernano/status/514866681530023936 My perl scripts call $out = `git pull`, log to a file, and print a response; I was quite surprised the exploit worked against them. Promptly disabled, upgraded bash, and re-enabled, now disabling all cgi for a bit longer. What are t…
Yes, this exploit can be used on any script or program that uses system(), whatever language you use.
Using bash as the default /bin/sh is the real bug here.
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#107Earlier quoted context omitted.
Are you seeing any from IP addresses besides 209.126.230.72, which is Robert Graham scanning the Internet[1]? [1] http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...
I am seeing: web22 ~> grep "() {" logs/access_log 209.126.230.72 - - [24/Sep/2014:17:16:46 -0700] "GET / HTTP/1.0" 200 5733 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)" 13378 () { :; }; ping -c 23 209.126.230.74 80 74529
Thanks for that command btw; I got scanned by erratasec :D
209.126.230.72 - - [24/Sep/2014:23:13:20 +0200] "GET / HTTP/1.0" 200 29301 "() { :; }; ping -c 11 216.75.60.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"
209.126.230.72 - - [25/Sep/2014:08:45:00 +0200] "GET / HTTP/1.0" 200 29292 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)"Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#108RHEL made a C shared object available that you can preload in everything which cleans up the environment of the magic "() {" bit : https://access.redhat.com/articles/1200223 (and apparently exactly that sequence has magic meaning; "( ) {" does not work )
For CGI scripts, only putting it in /etc/ld.so.preload worked for me. It seems like the CGI environment has LD_PRELOAD stripped (I checked /proc/apache_pid/environ which has LD_PRELOAD, but the CGI script running does not).
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#109What tools are people using to track and push out security updates, if any? Right now I only have a few servers to administer so apticron is sufficient for notification and upgrading isn't a burden. Also, does anyone have a way to push out patched packages fast? Imagine that a patch is available, or it's trivial to remove a feature that you're not using, but the distribution hasn't made a package yet. I have been dre…
Using salt to push out updates, easy and fast. "salt * pkg.install bash refresh=True"
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#110Proposed patch for CVE-2014-7169 here: http://www.openwall.com/lists/oss-security/2014/09/25/10 I am building bash updates for Ubuntu containing the proposed fix here and will publish them once the fix has been made official: https://launchpad.net/~ubuntu-security-proposed/+archive/ubu...
Possibly stupid question, but won't Ubuntu also publish these as soon as the fix is made available as well?