Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bash 'shellshock' bug is wormable

blog.erratasec.com

Post reply on HN
Print view View original

151–157 of 157 posts

Re: Bash 'shellshock' bug is wormable

#151

Post by eropple »

stephenr wrote: post #142
eropple wrote: post #132

Earlier quoted context omitted.

How? I already am running Chef on every machine I touch .

So you have a chef recipe to download and compile the same version of bash on every platform you use? How do you handle situations where bash is included by default? Do you remove the package or just push your binary over the top? If you don't remove it, what happens when a package update then replaces your binary? How often do you update the recipe to make sure it's getting the latest stable version and applying sec…

> So you have a chef recipe to download and compile the same version of bash on every platform you use?

No, I have a chef recipe to install the newest version of bash 4 everywhere. How is an implementation detail. (I use Ubuntu packages and Homebrew, I only compile on cygwin.)

> How do you handle situations where bash is included by default? Do you remove the package or just push your binary over the top?

On OS X, the only place that's the case, I replace the binary (by using the Homebrew-compiled one).

> How often do you update the recipe to make sure it's getting the latest stable version and applying security patches?

I've written the Chef recipe to not need regular updates. I run my Chef update stuff on a weekly basis. I can do so manually if I need to.

Re: Bash 'shellshock' bug is wormable

#152

Post by stephenr »

eropple wrote: post #149
mysidia wrote: post #146

Earlier quoted context omitted.

Perhaps he didn't deliver the point... but BASH is not a good or safe language to write to. Writing to '/bin/sh' is understandable due to its ubiquitousness. Bash is a superset that is not so ubiquitous, so it doesn't have the advantage that writing to /bin/sh does. If you don't want portable, then don't write to shell script. Write to Perl Ruby or Python, which is also safer and more secure.

/bin/bash is on literally every machine I ever touch. It is on every Debian machine. It is on every Ubuntu machine. It is on every OS X machine. It is on every Windows (!) machine. And there are plenty of operations that are significantly more cumbersome to write in Ruby--otherwise, sure, I would do so. Backticks are nice, but there's no `set -e` (that I am aware of) and it becomes a huge hassle to do things in a sma…

No-one claimed Bash isn't widely distributed and installed by default.

However, unless you are patching and compiling the same version of Bash, you absolutely do not have the same version on all those machines, and that is the whole reason NOT to target Bash in shell scripts - its features are not always consistent/compatible across versions.

Re: Bash 'shellshock' bug is wormable

#153

Post by dllthomas »

stephenr wrote: post #41
inportb wrote: post #29

Earlier quoted context omitted.

I suspect that many folks who "don't run bash" actually do use bash quite a bit, e.g. in initscripts and various software packages.

Any decent shell script is written to use "sh" not bash, and on debian/etc sh is provided by dash not bash. So while a lot of people are affected, your reasoning points to other issues that are very solveable

There is tremendous range in what a "shell script" might be. I vastly prefer bash to sh as a user shell. Often times, I have bits of logic I express in a command that I want to capture and reuse, and they get grabbed and dropped in a (frequently context specific) bin directory. I would contend that these "save me from typing it out" shell scripts should mimic what I would type myself. Once they wind up being more general, I usually rewrite them in a different language entirely. That's a very different context than something like an init script, though.

Re: Bash 'shellshock' bug is wormable

#154

Post by stephenr »

eropple wrote: post #151
stephenr wrote: post #142

Earlier quoted context omitted.

So you have a chef recipe to download and compile the same version of bash on every platform you use? How do you handle situations where bash is included by default? Do you remove the package or just push your binary over the top? If you don't remove it, what happens when a package update then replaces your binary? How often do you update the recipe to make sure it's getting the latest stable version and applying sec…

> So you have a chef recipe to download and compile the same version of bash on every platform you use? No, I have a chef recipe to install the newest version of bash 4 everywhere. How is an implementation detail. (I use Ubuntu packages and Homebrew, I only compile on cygwin.) > How do you handle situations where bash is included by default? Do you remove the package or just push your binary over the top? On OS X, th…

Bash is known to have version/compatibility issues - Homebrew reports Bash 4.3, but Ubuntu only has 4.3 available for the most recent version - anything from before April will only get 4.2.

This is my whole point - targeting /bin/sh means targeting a POSIX compliant shell, which may be implemented by any number of different codebases, with a defined standard to meet. Posix mode in Bash 4.3 should be the same as Posix mode in Bash 3.9, etc. - targeting /bin/bash means targeting whatever specific bash oddities come with the version installed.

Re: Bash 'shellshock' bug is wormable

#155

Post by eropple »

lutusp wrote: post #150
eropple wrote: post #149

Earlier quoted context omitted.

/bin/bash is on literally every machine I ever touch. It is on every Debian machine. It is on every Ubuntu machine. It is on every OS X machine. It is on every Windows (!) machine. And there are plenty of operations that are significantly more cumbersome to write in Ruby--otherwise, sure, I would do so. Backticks are nice, but there's no `set -e` (that I am aware of) and it becomes a huge hassle to do things in a sma…

> /bin/bash is on literally every machine I ever touch. It is on every Debian machine. It is on every Ubuntu machine. It is on every OS X machine. It is on every Windows (!) machine. Yes. Yes. Yes. Yes. No (unless Cygwin is installed).

/bin/bash is on literally every machine I ever touch. Did you miss the operative phrase?

(I have init scripts for Cygwin, too, because I need Windows but life is too short for CSRSS.)

Re: Bash 'shellshock' bug is wormable

#156

Post by eropple »

stephenr wrote: post #154
eropple wrote: post #151

Earlier quoted context omitted.

> So you have a chef recipe to download and compile the same version of bash on every platform you use? No, I have a chef recipe to install the newest version of bash 4 everywhere. How is an implementation detail. (I use Ubuntu packages and Homebrew, I only compile on cygwin.) > How do you handle situations where bash is included by default? Do you remove the package or just push your binary over the top? On OS X, th…

Bash is known to have version/compatibility issues - Homebrew reports Bash 4.3, but Ubuntu only has 4.3 available for the most recent version - anything from before April will only get 4.2. This is my whole point - targeting /bin/sh means targeting a POSIX compliant shell, which may be implemented by any number of different codebases, with a defined standard to meet. Posix mode in Bash 4.3 should be the same as Posix…

That's a fair point for bash ultra-power users. It doesn't really reflect on my use case. I don't exactly pull out all the stops. I use [[ ]] and set -e, which have very familiar semantics that haven't changed for a long time, and that's about it. I am very confident in my selection of "portable bash"-isms as far back as 3.2 (running 4.x on OS X has only come on recent, I added it a couple months ago).

Don't get me wrong: I could use /bin/sh. But I would have to write worse code to do it. I'll take the possibility of a bash regression over writing all my shell scripts in sh.

Re: Bash 'shellshock' bug is wormable

#157

Post by lutusp »

eropple wrote: post #155
lutusp wrote: post #150

Earlier quoted context omitted.

> /bin/bash is on literally every machine I ever touch. It is on every Debian machine. It is on every Ubuntu machine. It is on every OS X machine. It is on every Windows (!) machine. Yes. Yes. Yes. Yes. No (unless Cygwin is installed).

/bin/bash is on literally every machine I ever touch . Did you miss the operative phrase? (I have init scripts for Cygwin, too, because I need Windows but life is too short for CSRSS.)

> /bin/bash is on literally every machine I ever touch. Did you miss the operative phrase?

You intended that subjunctive clause to apply to all the sentences, an intent I missed. My mistake. :)

This may soon become a tempest in a teapot, as patched Bash versions are now appearing. I just patched all my machines.

Post reply on HN