Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

seclists.org

Post reply on HN
Print view View original

21–30 of 226 posts

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#21

Post by jewel »

What tools are people using to track and push out security updates, if any? Right now I only have a few servers to administer so apticron is sufficient for notification and upgrading isn't a burden.

Also, does anyone have a way to push out patched packages fast? Imagine that a patch is available, or it's trivial to remove a feature that you're not using, but the distribution hasn't made a package yet. I have been dreaming of making a system to help debian users create and manage a local set of packages, but haven't really had a chance to take it to a point where it'd be helpful in this scenario.

My extended thoughts on the matter: http://stevenjewel.com/2013/10/hacking-open-source/

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#23

Post by agwa »

jtchang wrote: post #22

I'm starting to see automated attack attempts using HTTP_HOST headers set to '() {'.

Are you seeing any from IP addresses besides 209.126.230.72, which is Robert Graham scanning the Internet[1]?

[1] http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#24

Post by namidark »

jewel wrote: post #21

What tools are people using to track and push out security updates, if any? Right now I only have a few servers to administer so apticron is sufficient for notification and upgrading isn't a burden. Also, does anyone have a way to push out patched packages fast? Imagine that a patch is available, or it's trivial to remove a feature that you're not using, but the distribution hasn't made a package yet. I have been dre…

Shameless plug as the owner: https://sysward.com/ - this is one of the reasons I built this - there is even a package view so you can apply just this package update across your systems. Message me if you have any questions!

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#25

Post by stock_toaster »

songgao wrote: post #18

OK two questions: 1. Does zsh (or other shells) also have these kind of string processings where bugs are likely? 2. Is there a way to completely remove bash from the system and use zsh (or other shells) instead?

It really depends on the *nix you are running.

FreeBSD, for example, only had bash as a port and it is not in the base install -- I believe `/bin/sh` is a derivative of ash[1].

[1]: http://en.wikipedia.org/wiki/Almquist_shell

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#26

Post by eropple »

songgao wrote: post #18

OK two questions: 1. Does zsh (or other shells) also have these kind of string processings where bugs are likely? 2. Is there a way to completely remove bash from the system and use zsh (or other shells) instead?

1. This exact bug, I dunno? From what I know about zsh, no, but what I don't know about zsh can fill books. But general string bugs? Probably. String processing is hard.

2. Possible yes, practical no (for most folks). Almost everybody's got a bunch of scripts with `#! /bin/bash` or `#! /usr/bin/env bash` lying around. Good luck excising everything that automatically assumes it's the shell of choice.

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#28

Post by daddykotex »

namidark wrote: post #24
jewel wrote: post #21

What tools are people using to track and push out security updates, if any? Right now I only have a few servers to administer so apticron is sufficient for notification and upgrading isn't a burden. Also, does anyone have a way to push out patched packages fast? Imagine that a patch is available, or it's trivial to remove a feature that you're not using, but the distribution hasn't made a package yet. I have been dre…

Shameless plug as the owner: https://sysward.com/ - this is one of the reasons I built this - there is even a package view so you can apply just this package update across your systems. Message me if you have any questions!

I have a security warning from Chrome on my phone as of now. Maybe you want to look into that!

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#29

Post by nacs »

daddykotex wrote: post #28
namidark wrote: post #24

Earlier quoted context omitted.

Shameless plug as the owner: https://sysward.com/ - this is one of the reasons I built this - there is even a package view so you can apply just this package update across your systems. Message me if you have any questions!

I have a security warning from Chrome on my phone as of now. Maybe you want to look into that!

No warnings about SSL on iPhone Safari. Are you on Android?

(Disclaimer: not affiliated with Sysward)

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#30

Post by Hytosys »

eropple wrote: post #26
songgao wrote: post #18

OK two questions: 1. Does zsh (or other shells) also have these kind of string processings where bugs are likely? 2. Is there a way to completely remove bash from the system and use zsh (or other shells) instead?

1. This exact bug, I dunno? From what I know about zsh, no, but what I don't know about zsh can fill books. But general string bugs? Probably. String processing is hard. 2. Possible yes, practical no (for most folks). Almost everybody's got a bunch of scripts with `#! /bin/bash` or `#! /usr/bin/env bash` lying around. Good luck excising everything that automatically assumes it's the shell of choice.

`ln -s /bin/zsh /bin/bash`?
Post reply on HN