I have a macbookpro which is my developer workstation. It is in a default configuration, it is on 12 hours a day, always behind a NAT. What do I need to do to protect myself?
Bash 'shellshock' bug is wormable
21–30 of 157 posts
Re: Bash 'shellshock' bug is wormable
#22From one of the comments: > The question isn't whether a CGI is written in bash, but if it calls out to bash no matter how indirectly. Lots of things use the system() libc function, so if /bin/sh is bash it's game over. Is this true? Which systems are vulnerable to this by default?
I think you need that + the ability to add anything to an environment variable. Not sure how easy that is. edit: reading this looks like its exploiting CGI scripts, presumeably through the host header
Setting an environment variable is often pretty easy, but the Host: header is the wrong way to go. The webserver will usually ignore a bad Host: header. User-agent: is much more availing.
Re: Bash 'shellshock' bug is wormable
#23I have a macbookpro which is my developer workstation. It is in a default configuration, it is on 12 hours a day, always behind a NAT. What do I need to do to protect myself?
update bash (https://apple.stackexchange.com/questions/146849/how-do-i-re...)
or switch to a different system default shell until bash is updated.
Re: Bash 'shellshock' bug is wormable
#24Test your local machine:
export evil='() { :;}; echo vulnerable'; bash -c echo;
Vulnerable computers will print 'vulnerable'.
Test a CGI:
curl -i -X HEAD "http://website" -A '() { :;}; echo "Warning: Server Vulnerable"'
Vulnerable scripts will emit a "Warning" header. If you get a 405 error, try it with a GET request.
I don't know the PoC fo new version which wiggles around the patch.
I've tried the PoC on ksh, csh, and dash; if they're effected, its more nuanced. Its advisable to rename bash, and replace it with a symlink to dash; it shouldn't break any scripts, and even if it does its better than getting owned.
mv /bin/bash /bin/_bash
chmod ugo-x /bin/_bash
ln -s /bin/dash /bin/bash
Re: Bash 'shellshock' bug is wormable
#25Earlier quoted context omitted.
This is a completely bonkers, Slammer-level hair-on-fire vulnerability. Remember Heartbleed? This is much worse. If you have a computer with an OS other than Windows or Android, your safest bet is to unplug it from the Internet until the bash developers figure this all out.
[deleted]
My version of ash seems unaffected. Do you have more info?
# env x='() { :;}; echo vulnerable' /bin/sh -c "echo this is a test"
this is a test
# env x='() { :;}; echo vulnerable' /bin/ash -c "echo this is a test"
this is a testRe: Bash 'shellshock' bug is wormable
#26This is probably just a local problem in what I will euphemistically describe as my "very highly customized" shell, but... it might be useful to use "/usr/bin/env instad of just plain "env" in that one-liner test for the vulnerability.
(or maybe the "command" builtin instead? It seems to also 'properly' show the vulnerability as well, but I'm not if that would affect the test in some cases)
Re: Bash 'shellshock' bug is wormable
#27Yep. We're currently basically waiting to see which completes first: a) a patch for bash which actually works gets released and then trickles into the various ways to get it on every machine in the world or b) someone writes ~10 lines of payload code (download rootkit, execute, connect to IRC channel, join botnet, etc) and then just hits everything in IP4 space with a for loop. Optionally, the for loop gets distribut…
I run no Linux/Unix/MacOS/compatible/etc machine which connects other machines How about "I don't run bash"? There are other perfectly good shells, you know...
You and Thomas can ignore everything I say about security. J. Random Rails Developer, on the other hand, probably gets useful signal if I start panicking. (Am I panicking? YES.)
Re: Bash 'shellshock' bug is wormable
#28Shellshock is also "reverse-shell-able". This Python script relies on /dev/tcp which is not available by default on some distros. (Source: @ortegaalfredo) But you could probably rework it to use netcat.
Re: Bash 'shellshock' bug is wormable
#29Yep. We're currently basically waiting to see which completes first: a) a patch for bash which actually works gets released and then trickles into the various ways to get it on every machine in the world or b) someone writes ~10 lines of payload code (download rootkit, execute, connect to IRC channel, join botnet, etc) and then just hits everything in IP4 space with a for loop. Optionally, the for loop gets distribut…
I run no Linux/Unix/MacOS/compatible/etc machine which connects other machines How about "I don't run bash"? There are other perfectly good shells, you know...
I suspect that many folks who "don't run bash" actually do use bash quite a bit, e.g. in initscripts and various software packages.
Re: Bash 'shellshock' bug is wormable
#30Yep. We're currently basically waiting to see which completes first: a) a patch for bash which actually works gets released and then trickles into the various ways to get it on every machine in the world or b) someone writes ~10 lines of payload code (download rootkit, execute, connect to IRC channel, join botnet, etc) and then just hits everything in IP4 space with a for loop. Optionally, the for loop gets distribut…
I run no Linux/Unix/MacOS/compatible/etc machine which connects other machines How about "I don't run bash"? There are other perfectly good shells, you know...
Or "I don't run UNIXes that default to bash, or hide it under /bin/sh, etc."
Unfortunately, bash shows up in surprising places, including default Solaris installs nowadays.
On OSX and Solaris, I've chmod'ed 0000 /bin/bash with no apparent ill effect so far. I'll put more effort into establishing its acceptability as a solution tomorrow.
BSDs won't have bash unless someone has gone out of their way to install it, which can be undone straightforwardly.
But it could be a long night for our Linux brethren and sistren.
Good luck, and remember to stay hydrated. :)
EDIT: obviously, don't chmod 0000 your login shell! Fix that first. Make sure whatever you switch to isn't a symbolic or hard link to bash.