Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bash 'shellshock' bug is wormable

blog.erratasec.com

Post reply on HN
Print view View original

111–120 of 157 posts

Re: Bash 'shellshock' bug is wormable

#111

Post by stephenr »

eropple wrote: post #107
stephenr wrote: post #57

Earlier quoted context omitted.

I guess it comes down to how you interpret things. I specifically said any decent shell script. My logic is that if it is not using "sh", but instead relying on bash (or any other specific shell really), it's not a decent shell script. If I were to amend the sentence to make the meaning clearer, I would still not use "should be", I would use "must be".

You're overreaching. I write scripts against bash, not sh, because it's a better scripting language for what I need. It's more readable and its constructs are easier (for me) to follow. I don't care about POSIX-compatibility when bash can be installed literally anywhere. It's a dependency for the devops stuff that I run and maintain, much like Ruby is a dependency and all the gems in my Gemfile. It's a considered dec…

I suggest you read the accepted answer at http://stackoverflow.com/questions/19428418/what-is-the-use-... for a brief look at why portable shell scripts are a better solution than bash specific scripts.

Re: Bash 'shellshock' bug is wormable

#112

Post by drzaiusapelord »

patio11 wrote: post #91
bodyfour wrote: post #84

Earlier quoted context omitted.

It won't be as simple as scanning all IP4 space because for most vulnerable hosts you still will need to know a URL of a cgi program that can cause bash to be executed (either because they're written in shell or, more likely, that there is some path found that can cause popen()/system()/etc to be called) If you read Robert Graham's blog post about his scan for this (posted to HN earlier today) he mentioned that the h…

I think you underestimate attack vectors. d6c477a79ea7a633c2bb0e358e32399c1b18eb7d <-- Will ruin 1+ HNers' day sooner rather than later if they don't patch. Successful exploit doesn't require the exploit writer even knowing that vector existed to say nothing of successfully guessing a URL.

>Successful exploit doesn't require the exploit writer even knowing that vector existed to say nothing of successfully guessing a URL.

I'm not following. My CGI application is at example.com/stuff/cgi/webapp

So now the attack doesn't need to append /stuff/cgi/webapp? It can just point to example.com? How does that work?

Re: Bash 'shellshock' bug is wormable

#114

Post by smellf »

wiredfool wrote: post #32
cperciva wrote: post #18

Earlier quoted context omitted.

I run no Linux/Unix/MacOS/compatible/etc machine which connects other machines How about "I don't run bash"? There are other perfectly good shells, you know...

Someone is going to be going through busybox soon, and then there (potentially) will be a whole bunch more exploitable boxes that don't have a generally have a regular update cycle.

You're right, of course. Exploitable weaknesses in busybox are going to be killer - I think shellshock will turn out to be the start of something really big.

But, to clarify for others, the existing shellshock PoC doesn't work on the busybox environment I tested (v1.20.2).

Re: Bash 'shellshock' bug is wormable

#115

Post by smellf »

_xnmw wrote: post #83
patio11 wrote: post #2

Yep. We're currently basically waiting to see which completes first: a) a patch for bash which actually works gets released and then trickles into the various ways to get it on every machine in the world or b) someone writes ~10 lines of payload code (download rootkit, execute, connect to IRC channel, join botnet, etc) and then just hits everything in IP4 space with a for loop. Optionally, the for loop gets distribut…

What about using the exploit to remotely patch machines?

That's a very cool idea.

Re: Bash 'shellshock' bug is wormable

#116

Post by eropple »

stephenr wrote: post #111
eropple wrote: post #107

Earlier quoted context omitted.

You're overreaching. I write scripts against bash, not sh, because it's a better scripting language for what I need. It's more readable and its constructs are easier (for me) to follow. I don't care about POSIX-compatibility when bash can be installed literally anywhere. It's a dependency for the devops stuff that I run and maintain, much like Ruby is a dependency and all the gems in my Gemfile. It's a considered dec…

I suggest you read the accepted answer at http://stackoverflow.com/questions/19428418/what-is-the-use-... for a brief look at why portable shell scripts are a better solution than bash specific scripts.

I suggest you read my post and maybe let it roll around your head that I've considered my environment and the domain of my problems in a way you aren't giving me credit for. Perhaps even, with that whole mention of devops, I do something such as--crazy thought incoming--install an updated version of bash on every system I must provision, just as I do Ruby, Python, etc.?

"Decent shell script" is not a synonym for "portable shell script" and the presumption therein is what I was addressing.

Re: Bash 'shellshock' bug is wormable

#119

Post by sophacles »

hamstergene wrote: post #113

I'm really surprised how many people out there write CGI in Bash. That's one of the things which would have never crossed my mind.

It's less about writing CGI in bash, and more about writing CGI, then eventually calling system() from within the CGI program.

This is very common, particularly with monitoring pages, etc.

Re: Bash 'shellshock' bug is wormable

#120

Post by Tloewald »

gioele wrote: post #95
patio11 wrote: post #35

Earlier quoted context omitted.

Ease of exploitation and ease of discovery have basically nothing to do with each other. Relatedly, "many eyes makes all bugs shallow" is, and always has been, totally horsepuckey. (And despite it being horsepuckey, and horsepuckey which is trivially exploitable in that if you believe it you'll produce software which can get owned by people who are better at e.g. counting to four than you are, people still believe it…

> Relatedly, "many eyes makes all bugs shallow" is, and always has been, totally horsepuckey. Consider that the contraction of the more complete saying "Many eyes make bugs shallower than they would be if there were only few eyes".

But then there's the "Many eyes lead to a sense of complacency" issue -- like "No-one ever got fired for buying IBM|Microsoft|Blackberry"
Post reply on HN