221–230 of 432 posts
Amazon's Linux distro for EC2 is still waiting for a patch. EDIT: Finally got things updated. Bulletin can be found here: https://alas.aws.amazon.com/ALAS-2014-418.html If yum isn't finding the update, try running "yum clean all" and then "yum update bash"
Earlier quoted context omitted.
Where is the privilege escalation? I get the same results from running id through tripping the bug as I do from running id directly. Edited to add: Also no differences in capabilities when I cat /proc/self/status None of which is to say there is clearly no such vulnerability - I'd just like to understand it if there is.
Privilege escalation is not static. I know systems where bash has been patched to allow execution by certain users, etc. With this, you can inject commands before such check takes place. Etc.
It is a very good thing that Debian and Ubuntu use /bin/dash for /bin/sh by default, since /bin/sh is implicitly invoked all over the place (e.g. by system(3)). Distros which use /bin/bash for /bin/sh are gonna have a bad time. Edit: not implying that Debian and Ubuntu aren't affected too, just that the impact there will be lessened.
sh-3.2$ env x='() { :;}; echo vulnerable' /bin/sh -c "echo this is a test"
vulnerable
this is a testInterestingly enough ancient BASH version 3.2 on Mac OS X 10.9.5 is not vulnerable: $ echo $BASH_VERSION 3.2.51(1)-release $ x='() { :;}; echo vulnerable' bash -c "echo this is a test" bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' this is a test $ I manually patched my BASH 4.3 to patch level 25 so it's not vulnerable either. $ echo $BASH_VERSION 4.3.25(1)-re…
http://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052
Your paste indicates patch level 51.
The phrase in question doesn't appear on the internet much at all before today.
https://www.google.com/search?q="ignoring+function+definitio...
I presume that the one search result we see is due to a server that has an incorrect clock (or a time machine).
Wanted to share the simple Ansible script we used to patch CVE-2014-6271 at npm: https://github.com/npm/ansible-bashpocalypse
Interestingly enough ancient BASH version 3.2 on Mac OS X 10.9.5 is not vulnerable: $ echo $BASH_VERSION 3.2.51(1)-release $ x='() { :;}; echo vulnerable' bash -c "echo this is a test" bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' this is a test $ I manually patched my BASH 4.3 to patch level 25 so it's not vulnerable either. $ echo $BASH_VERSION 4.3.25(1)-re…
It is a very good thing that Debian and Ubuntu use /bin/dash for /bin/sh by default, since /bin/sh is implicitly invoked all over the place (e.g. by system(3)). Distros which use /bin/bash for /bin/sh are gonna have a bad time. Edit: not implying that Debian and Ubuntu aren't affected too, just that the impact there will be lessened.
Isn't /bin/sh vulnerable to the same thing? At least it seems for me: sh-3.2$ env x='() { :;}; echo vulnerable' /bin/sh -c "echo this is a test" vulnerable this is a test
Earlier quoted context omitted.
Google inurl:cgi-bin inurl:.sh
Yeah, that makes sense. Did you try it? Gets me ~6k of hits that have just 'sh' in the URL (without the dot), and are not what we're looking for, mostly forum posts asking about how to make a bash cgi-bin. (Answer from the future: don't). I _think_ putting quotes around the ".sh" is supported to force the result to really have the period before the sh in the url. inurl:cgi-bin inurl:".sh" 0 hits
inurl:cgi-bin "inurl:\.sh$"
Earlier quoted context omitted.
It's not just you. The fact that an environment variable can override e.g. "git" to do something else is a real problem requiring separate protection. However, that's effectively PATH injection rather than code injection so it's already addressed in many cases.
I might be misunderstanding this, but this can be accomplished through http request headers?
Earlier quoted context omitted.
Depends on whether you have mirrors.linode.com or the ubuntu servers set up in sources.list. I had to swap mine out.
Well, I didn't even know about mirrors.linode.com. Mine were still the ubuntu default servers. I guess apt-get from one of Linode's mirrors saves bandwidth? Or is it just more polite?