Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shellshock DHCP Remote Code Execution – Proof of Concept

trustedsec.com

Post reply on HN
Print view View original

21–30 of 160 posts

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#21

Post by danielweber »

kbar13 wrote: post #14
Klasiaster wrote: post #13

one more reason for networking done by network-manager or networkd (systemd) instead of bash scripts

that's some straw man you got there. Just because bash is vulnerable in this case doesn't mean that networkd/network-manager will never be vulnerable.

Does NetworkManager completely obviate the need for the DHCP binary to call shell scripts?

Those scripts often exist because if the sysadmin needs something special to happen on DHCP, this is where he sets it. It's not "DHCP scripts get run by/are shell scripts," it's "DHCP binaries are prepared to call out to external scripts."

I've had to write these shell scripts (using ksh, since OpenBSD, so those are safe).

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#23

Post by adamfeldman »

syshax wrote: post #20
mr_brown wrote: post #12

I believe there will be plenty of linux NASs that will be vulnerable for the forseeable future. NASs are usually bigger and more functional than routers, they tend to run a more full system. Many of these for exampe run bash as far as I remember: http://www.amazon.com/s/field-keywords=QNAP

Just FYI to other owners: Synology DSM 5.0-4493 Update 5 here: it uses busybox, so not vulnerable. synology> which bash synology> which sh /bin/sh synology> which ash /bin/ash synology> ls -l /bin/sh lrwxrwxrwx 1 root root 7 Jun 5 11:27 /bin/sh -> busybox synology> ls -l /bin/ash lrwxrwxrwx 1 root root 7 Jun 5 11:27 /bin/ash -> busybox

Thank you for checking out DSM! This comment saved me a bunch of time.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#24

Post by Maken »

danielweber wrote: post #21
kbar13 wrote: post #14

Earlier quoted context omitted.

that's some straw man you got there. Just because bash is vulnerable in this case doesn't mean that networkd/network-manager will never be vulnerable.

Does NetworkManager completely obviate the need for the DHCP binary to call shell scripts? Those scripts often exist because if the sysadmin needs something special to happen on DHCP, this is where he sets it. It's not "DHCP scripts get run by/are shell scripts," it's "DHCP binaries are prepared to call out to external scripts." I've had to write these shell scripts (using ksh, since OpenBSD, so those are safe).

Well, Network Manager for starters is a binary and not a shell script like the dhclient-script.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#25

Post by muyuu »

Sanddancer wrote: post #18
Klasiaster wrote: post #13

one more reason for networking done by network-manager or networkd (systemd) instead of bash scripts

NetworkManager's had vulnerabilities over the years ( http://www.cvedetails.com/product/5634/Gnome-Networkmanager.... ), as has systemd. Stating this as a reason to switch is ridiculous. One can easily switch to a much more audited, secure scripting environment, such as ksh, and still have all the power scripting brings.

Not saying I agree with GP, but "the power scripting brings" can be part of the problem. Scripting is used as a means to execute arbitrary commands on a single level privilege (that of the user hooking the scripts, very often root or some high-privilege user) as opposed to a limited set of application-specific functionality. This adds a whole level of complexity to the system, which in security terms is typically the kind of thing that will give you trouble.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#27

Post by azernik »

muyuu wrote: post #25
Sanddancer wrote: post #18

Earlier quoted context omitted.

NetworkManager's had vulnerabilities over the years ( http://www.cvedetails.com/product/5634/Gnome-Networkmanager.... ), as has systemd. Stating this as a reason to switch is ridiculous. One can easily switch to a much more audited, secure scripting environment, such as ksh, and still have all the power scripting brings.

Not saying I agree with GP, but "the power scripting brings" can be part of the problem. Scripting is used as a means to execute arbitrary commands on a single level privilege (that of the user hooking the scripts, very often root or some high-privilege user) as opposed to a limited set of application-specific functionality. This adds a whole level of complexity to the system, which in security terms is typically the…

Agreed. When in security classes we were taught to use e.g. execve() instead of system(), it wasn't because shells were thought of as particularly vulnerable. You just want to use a tool that has the minimum possible feature set, so you can be sure that no one malicious will be able to trick you into using even correctly-functioning features (e.g. through shell injection).

Sort of a special case of the principle of minimum privilege, when applied to the feature set of your tools.

Re: Shellshock DHCP Remote Code Execution – Proof of Concept

#29

Post by masklinn »

tdicola wrote: post #6
makomk wrote: post #4

Earlier quoted context omitted.

Thankfully embedded devices are less likely to have bash installed than desktop or server systems, or this would be quite nasty.

Are smaller shells like busybox affected though? I bet a lot of routers run it (I know mine with OpenWRT does).

The problem is very specific to bash and bash only (a hacky feature via environment variables so shells can inherit their parent's functions)
Post reply on HN