CVE-2014-6271: Remote code execution through bash • Hacker News Board

Re: CVE-2014-6271: Remote code execution through bash

#31

Post by nknighthb » Wed, Sep 24, 2014, 3:13 PM UTC

justincormack wrote: post #24

nknighthb wrote: post #19

Earlier quoted context omitted.

CGI has always been an accident waiting to happen, but hardly anybody uses it anymore anyway, and even more rarely in a manner that invokes bash, of all things. I fail to see how "HTTP requests" generically are a vector, and its "Here is a sample" statement is not a link and is followed by... nothing. This article tells me nothing useful other than "don't allow untrusted data into your environment", which we've all k…

People still shell out to do stuff from scripts from all sorts of languages. Unless these sanitize the environment they would be vulnerable.

Unless you're using CGI, your system environment will not be contaminated. CGI is vulnerable because it relies on passing untrusted data in environment variables. No other gateway interface I'm familiar with does.

Re: CVE-2014-6271: Remote code execution through bash

#32

Post by ars » Wed, Sep 24, 2014, 3:14 PM UTC

huhtenberg wrote: post #22

nknighthb wrote: post #19

Earlier quoted context omitted.

CGI has always been an accident waiting to happen, but hardly anybody uses it anymore anyway, and even more rarely in a manner that invokes bash, of all things. I fail to see how "HTTP requests" generically are a vector, and its "Here is a sample" statement is not a link and is followed by... nothing. This article tells me nothing useful other than "don't allow untrusted data into your environment", which we've all k…

> hardly anybody uses it anymore anyway Lots of PHP setups do.

Lots? Really?

PHP was one of the first to have a dedicated apache module. Perl is much more likely to be CGI.

Re: CVE-2014-6271: Remote code execution through bash

#33

Post by agwa » Wed, Sep 24, 2014, 3:14 PM UTC

aroch wrote: post #30

ForHackernews wrote: post #23

Earlier quoted context omitted.

Do you have a source for that? Some articles [0] claim "This affects Debian as well as other Linux distributions." [0] http://www.csoonline.com/article/2687265/application-securit...

Debian7 doesn't look to be vulnerable by default (if the code snippet can be trusted to work): [arch/testbed ~] uname -a Linux 3.2.0-4-amd64 #1 SMP Debian 3.2.54-2 x86_64 GNU/Linux [arch/testbed ~] env x='() { :;}; echo vulnerable' bash -c "echo this is a test" bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' this is a test

You appear to already have the updated package installed.

Re: CVE-2014-6271: Remote code execution through bash

#34

Post by korzun » Wed, Sep 24, 2014, 3:15 PM UTC

agwa wrote: post #17

It is a very good thing that Debian and Ubuntu use /bin/dash for /bin/sh by default, since /bin/sh is implicitly invoked all over the place (e.g. by system(3)). Distros which use /bin/bash for /bin/sh are gonna have a bad time. Edit: not implying that Debian and Ubuntu aren't affected too, just that the impact there will be lessened.

Major impact of this is elevating privileges, both Debian and Ubuntu will be impacted just like any other system.

I don't think anybody is worried about software on the system that is using /bin/bash .vs /bin/sh.

Re: CVE-2014-6271: Remote code execution through bash

#35

Post by cesarb » Wed, Sep 24, 2014, 3:15 PM UTC

ck2 wrote: post #18

Has the redhat patch been pushed through centos yet?

Apparently, no. When it does, it should appear at http://lists.centos.org/pipermail/centos-announce/2014-Septe... (if you admin CentOS servers, it can be a good idea to subscribe to that list).

Re: CVE-2014-6271: Remote code execution through bash

#36

Post by nknighthb » Wed, Sep 24, 2014, 3:16 PM UTC

huhtenberg wrote: post #22

nknighthb wrote: post #19

Earlier quoted context omitted.

CGI has always been an accident waiting to happen, but hardly anybody uses it anymore anyway, and even more rarely in a manner that invokes bash, of all things. I fail to see how "HTTP requests" generically are a vector, and its "Here is a sample" statement is not a link and is followed by... nothing. This article tells me nothing useful other than "don't allow untrusted data into your environment", which we've all k…

> hardly anybody uses it anymore anyway Lots of PHP setups do.

They would be too slow to be useful at any kind of real load. Are you sure you're not thinking of FastCGI? That doesn't pass data through the environment, it goes over a socket.

Re: CVE-2014-6271: Remote code execution through bash

#37

Post by gegenschall » Wed, Sep 24, 2014, 3:17 PM UTC

darklajid wrote: post #16

masterleep wrote: post #5

env x='() { :;}; echo vulnerable' bash -c "echo this is a test" From https://securityblog.redhat.com/2014/09/24/bash-specially-cr...

Whoa. I tried this, ran pacaur -Suy and .. it's patched. Arch was fast.