Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

seclists.org

Post reply on HN
Print view View original

111–120 of 226 posts

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#111

Post by bch »

reedloden wrote: post #105
[deleted] wrote: post #101

[deleted]

If it's truely unused, you should be using /bin/false instead of /bin/sh. Note that /bin/sh is not always dash in many cases, so just because you are using /bin/sh over /bin/bash doesn't mean you're not vulnerable.

Trivia: /bin/false (not surprisingly), exits with a failure. I read some time ago of some *nix (I don't recall which) recognizing that the attempt to start a shell (/bin/false) "failed" and helpfully starting /bin/sh for you so you could recover your system. I still use /bin/true as my "not a shell" shell for this reason.

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#112

Post by [deleted] »

papaf wrote: post #59
deckiedan wrote: post #49

OK - so assuming that there isn't going to be a single patch which fixes all possible / related bugs any time soon. Options? - Change /bin/sh to something else. (CentOS has BASH as default, alas...) - Filter out unknown, or suspicious looking HTTP vars / env vars at varnish/apache/nginx level, somehow... (doesn't stop other services) - Figure out some clever SELinux configuration that blocks it. I wonder how much wou…

I just followed the following instructions on Arch for replacing bash with dash: https://wiki.archlinux.org/index.php/Dash The technique is applicable to other distributions as well. Note: on my Arch install the checks showed there were no scripts relying on /bin/sh being bash. Edit: direct link to checkbashisms.pl - http://anonscm.debian.org/cgit/collab-maint/devscripts.git/p...

[deleted]

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#113

Post by rlpb »

philipn wrote: post #110
mdeslaur wrote: post #82

Proposed patch for CVE-2014-7169 here: http://www.openwall.com/lists/oss-security/2014/09/25/10 I am building bash updates for Ubuntu containing the proposed fix here and will publish them once the fix has been made official: https://launchpad.net/~ubuntu-security-proposed/+archive/ubu...

Possibly stupid question, but won't Ubuntu also publish these as soon as the fix is made available as well?

mdeslaur is an Ubuntu security engineer.

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#114

Post by minhajuddin »

Erwin wrote: post #108

RHEL made a C shared object available that you can preload in everything which cleans up the environment of the magic "() {" bit : https://access.redhat.com/articles/1200223 (and apparently exactly that sequence has magic meaning; "( ) {" does not work ) For CGI scripts, only putting it in /etc/ld.so.preload worked for me. It seems like the CGI environment has LD_PRELOAD stripped (I checked /proc/apache_pid/environ w…

Is this an alternative to the bash upgrade or is this needed to fix the issue after the bash upgrade (because of an incomplete patch)?

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#115

Post by philipn »

rlpb wrote: post #113
philipn wrote: post #110

Earlier quoted context omitted.

Possibly stupid question, but won't Ubuntu also publish these as soon as the fix is made available as well?

mdeslaur is an Ubuntu security engineer.

Ahah, okay, makes sense. Thanks!

And THANK YOU SO MUCH for all your amazing work on this stuff, mdeslaur!

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#116

Post by rlpb »

jewel wrote: post #21

What tools are people using to track and push out security updates, if any? Right now I only have a few servers to administer so apticron is sufficient for notification and upgrading isn't a burden. Also, does anyone have a way to push out patched packages fast? Imagine that a patch is available, or it's trivial to remove a feature that you're not using, but the distribution hasn't made a package yet. I have been dre…

On Debian or Ubuntu, install the unattended-upgrades package. Configure it to install security updates only.

> ...but the distribution hasn't made a package yet.

On Ubuntu, I think you can probably set up a Launchpad PPA and then configure unattended-upgrades to automatically pull from it. Then just push what you need to that PPA when you're ready.

If you want to host the repository elsewhere, then that's possible too, but you probably want to start with a PPA since you don't have to worry about build and publishing infrastructure to start off with.

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#117

Post by someguy222 »

cft wrote: post #72
agwa wrote: post #23

Earlier quoted context omitted.

Are you seeing any from IP addresses besides 209.126.230.72, which is Robert Graham scanning the Internet[1]? [1] http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...

I am seeing: web22 ~> grep "() {" logs/access_log 209.126.230.72 - - [24/Sep/2014:17:16:46 -0700] "GET / HTTP/1.0" 200 5733 "() { :; }; ping -c 11 209.126.230.74" "shellshock-scan (http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html)" 13378 () { :; }; ping -c 23 209.126.230.74 80 74529

very interesting one: 89.207.135.125 - - * () { :;}; /bin/ping -c 1 198.101.206.138"

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#118

Post by m4r71n »

minhajuddin wrote: post #114
Erwin wrote: post #108

RHEL made a C shared object available that you can preload in everything which cleans up the environment of the magic "() {" bit : https://access.redhat.com/articles/1200223 (and apparently exactly that sequence has magic meaning; "( ) {" does not work ) For CGI scripts, only putting it in /etc/ld.so.preload worked for me. It seems like the CGI environment has LD_PRELOAD stripped (I checked /proc/apache_pid/environ w…

Is this an alternative to the bash upgrade or is this needed to fix the issue after the bash upgrade (because of an incomplete patch)?

It's a workaround that should be used if you must mitigate the issue right at this moment. Applying the update, once it's available, should do the same thing. Note that the workaround might have some unintended consequences as mentioned in the FAQ section of [1].

[1] https://access.redhat.com/articles/1200223

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#119

Post by ygra »

userbinator wrote: post #62

It looks like the important part of the patch (bash43-025) is here: In builtins/evalstring.c: if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def) In variables.c: parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD); So what the patch does is create a special mode of parse_and_execute() where it's supposed to only evaluate function definitions. A better option would…

Wouldn't that break the feature? Function definitions need to be executed so that they are available, right?
Post reply on HN