Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bash 'shellshock' bug is wormable

blog.erratasec.com

Post reply on HN
Print view View original

131–140 of 157 posts

Re: Bash 'shellshock' bug is wormable

#131

Post by Silhouette »

regularfry wrote: post #81
f00ber wrote: post #69

Oh stop this stupidity already. If you are not running a Web server that spawns bash when serving an HTTP request, then you are NOT vulnerable. Are you running a Web server that uses CGI scripts written in shell or plain C that uses system() call? If you do, you have had other problems long before. There are some grumblings about DHCP _client_ setups on Linux passing parameters via environment variables to shell scri…

Forgive me if I've misunderstood the problem, but isn't, for instance, a perl cgi script which happens to shell out to bash for some incidental functionality also vulnerable? The environment variable should get inherited.

Yes. Just about anything that winds up running bash with an unsanitized environment that an attacker could influence is potentially vulnerable. The GP poster has no idea what they are talking about.

Re: Bash 'shellshock' bug is wormable

#132

Post by eropple »

stephenr wrote: post #130
eropple wrote: post #116

Earlier quoted context omitted.

I suggest you read my post and maybe let it roll around your head that I've considered my environment and the domain of my problems in a way you aren't giving me credit for. Perhaps even, with that whole mention of devops, I do something such as--crazy thought incoming--install an updated version of bash on every system I must provision, just as I do Ruby, Python, etc.? "Decent shell script" is not a synonym for "por…

> "Decent shell script" is not a synonym for "portable shell script" Only for you. For me and a lot of others I suspect, if it isn't portable it isn't worth the trouble. If you have to re-compile a newer/older version of a shell to get the same results across machines, any potential benefits start to seem insignificant compared to the effort involved.

How? I already am running Chef on every machine I touch.

Re: Bash 'shellshock' bug is wormable

#133

Post by wglb »

gioele wrote: post #95
patio11 wrote: post #35

Earlier quoted context omitted.

Ease of exploitation and ease of discovery have basically nothing to do with each other. Relatedly, "many eyes makes all bugs shallow" is, and always has been, totally horsepuckey. (And despite it being horsepuckey, and horsepuckey which is trivially exploitable in that if you believe it you'll produce software which can get owned by people who are better at e.g. counting to four than you are, people still believe it…

> Relatedly, "many eyes makes all bugs shallow" is, and always has been, totally horsepuckey. Consider that the contraction of the more complete saying "Many eyes make bugs shallower than they would be if there were only few eyes".

Given that this is a 20 year old bug, that suggests that the number of eyes on this code were either zero or uninterested.

Also, the BEAST bug was identified 20 years ago and nothing was done until Thai and Juliano caused a mild panic.

Re: Bash 'shellshock' bug is wormable

#134

Post by eropple »

krunkosaurus wrote: post #129

Isn't this all just armchair prophesying? Let's see some screenshots actual exploits from anyone. It's hard to gain access to someone's shell unless it's 1990 and a server is using CGI-BIN. People are retweeting that this is "WORSE THAN HEARTBLEED!!!!111!" but Heartbleed literally left practically every server susceptible. I ran sample exploit code against a number of tests hosts and saw mysql queries and passwords s…

Well, that depends. Are you running Passenger?

http://blog.phusion.nl/2014/09/25/security-advisory-phusion-...

What about the rest of your servers? I can't claim to know that none of mine don't call system() somewhere deep in them.

Re: Bash 'shellshock' bug is wormable

#135

Post by wglb »

ccvannorman wrote: post #128

Sorry in advance for noobing up this thread, but can you clarify this? As a Mac OS X user who connects to public wifi often, I'm still in the dark about whether I should literally turn off my wifi for now.. or am I safe?

The problem comes about if your mac is serving web pages. If you aren't then there is less worry.

Re: Bash 'shellshock' bug is wormable

#136

Post by wglb »

grimtrigger wrote: post #17
amalcon wrote: post #10

Earlier quoted context omitted.

This is a completely bonkers, Slammer-level hair-on-fire vulnerability. Remember Heartbleed? This is much worse. If you have a computer with an OS other than Windows or Android, your safest bet is to unplug it from the Internet until the bash developers figure this all out.

And my servers? Is there anything I can do without taking them offline?

I patched mine with a apt-get update sequence. It fixed the bug (first fix, not yet the second), and I didn't have to take the server down. Everything stayed up.

Re: Bash 'shellshock' bug is wormable

#137

Post by eropple »

f00ber wrote: post #121
clarry wrote: post #76

Earlier quoted context omitted.

It is hilarious that you claim this is not remotely exploitable in response to a post describing how a very simple and limited scan has already found thousands of vulnerable hosts in a short timeframe . And I dare say there are lots of admins who do not know exactly what their servers are going to execute because they're using software written by other people. That's why we call them admins, not software developers.…

Well, let these _admins_ worry about this. This is of no concern for the moment for a regular Linux or OS X user. Now, an admin _must_ know every service running on entrusted boxes facing the Internet. CGI scripts hopefully are not common these days. If you run them do stop for other reasons. So far every "attack vector" implies having shell access to the target machine in some form. No need to panic for majority of…

Or, you know, running Rails with Passenger.

Re: Bash 'shellshock' bug is wormable

#138

Post by Salemzzz »

wglb wrote: post #135
ccvannorman wrote: post #128

Sorry in advance for noobing up this thread, but can you clarify this? As a Mac OS X user who connects to public wifi often, I'm still in the dark about whether I should literally turn off my wifi for now.. or am I safe?

The problem comes about if your mac is serving web pages. If you aren't then there is less worry.

I think even just using DHCP put your Mac at risk: https://www.trustedsec.com/september-2014/shellshock-dhcp-rc...

Re: Bash 'shellshock' bug is wormable

#139

Post by f00ber »

clarry wrote: post #126
f00ber wrote: post #122

Earlier quoted context omitted.

Please give me an example of how somebody not running a Web server and a collection of CGI scripts is affected. A git server? Are you running one of these? Move on, nothing to see for most of us.

You're in the wrong place. Hacker News isn't "Linux Grandmas' User Group". We're a varied bunch, many of us are admins or software developers, and yes we operate servers. For a living or otherwise. Security announcements like this are both interesting (hackers, remember?) and relevant to what many of us do.

Well, then do be clear that "If you are a Linux admin that runs a Web server that invokes code via old style CGI interface, then go and update". Please stop spreading panic among uninformed people.

If you are running stuff via CGI or allow random people to invoke shell on your servers, then you have bigger problems than a bug in bash. A shell was never meant to be secure.

Yes, I am a systems engineer too.

Re: Bash 'shellshock' bug is wormable

#140

Post by f00ber »

ccvannorman wrote: post #127
f00ber wrote: post #121

Earlier quoted context omitted.

Well, let these _admins_ worry about this. This is of no concern for the moment for a regular Linux or OS X user. Now, an admin _must_ know every service running on entrusted boxes facing the Internet. CGI scripts hopefully are not common these days. If you run them do stop for other reasons. So far every "attack vector" implies having shell access to the target machine in some form. No need to panic for majority of…

Can you clarify this? As a Mac OS X user who connects to public wifi often, I'm still in the dark about whether I should literally turn off my wifi for now..

I don't think DHCP in Mac OS X is affected. I am yet to see a proof that any Linux client is affected either. I am pretty sure that a few dozen servers that happily serve Web content within my reach are not affected either.

If idiots could stop spreading panic and clearly state the conditions and risks, we'd all be served better.

Post reply on HN