Patched all the CentOS machines hours ago, whew.
It's on yum now, just yum update
Bash 'shellshock' bug is wormable
31–40 of 157 posts
Re: Bash 'shellshock' bug is wormable
#32Yep. We're currently basically waiting to see which completes first: a) a patch for bash which actually works gets released and then trickles into the various ways to get it on every machine in the world or b) someone writes ~10 lines of payload code (download rootkit, execute, connect to IRC channel, join botnet, etc) and then just hits everything in IP4 space with a for loop. Optionally, the for loop gets distribut…
I run no Linux/Unix/MacOS/compatible/etc machine which connects other machines How about "I don't run bash"? There are other perfectly good shells, you know...
Someone is going to be going through busybox soon, and then there (potentially) will be a whole bunch more exploitable boxes that don't have a generally have a regular update cycle.
Re: Bash 'shellshock' bug is wormable
#33Earlier quoted context omitted.
This is a completely bonkers, Slammer-level hair-on-fire vulnerability. Remember Heartbleed? This is much worse. If you have a computer with an OS other than Windows or Android, your safest bet is to unplug it from the Internet until the bash developers figure this all out.
And my servers? Is there anything I can do without taking them offline?
Well, you could remove bash entirely (say, by replacing it with a link to dash). Doing this will likely break things, however, up to and including rendering the machine unbootable depending on which distribution it is and how the init scripts are written.
You could replace bash with e.g. a perl script that strips parenthesis from your environment variables, and then invokes a differently named copy of bash. That might not break anything. Then again, it might.
Re: Bash 'shellshock' bug is wormable
#34Earlier quoted context omitted.
This is a completely bonkers, Slammer-level hair-on-fire vulnerability. Remember Heartbleed? This is much worse. If you have a computer with an OS other than Windows or Android, your safest bet is to unplug it from the Internet until the bash developers figure this all out.
[deleted]
Huh, I literally just checked all the shells on my android device (with code that worked on my laptop earlier), and it didn't seem vulnerable. Are you talking about a different vulnerability?
Re: Bash 'shellshock' bug is wormable
#35Honest question: does this mean this vulnerability has been in bash for essentially its entire history and someone only discovered it now? Seems quite likely that someone would have discovered it sooner, especially since it's so simple to exploit.
Ease of exploitation and ease of discovery have basically nothing to do with each other.
Relatedly, "many eyes makes all bugs shallow" is, and always has been, totally horsepuckey. (And despite it being horsepuckey, and horsepuckey which is trivially exploitable in that if you believe it you'll produce software which can get owned by people who are better at e.g. counting to four than you are, people still believe it to this day.)
Re: Bash 'shellshock' bug is wormable
#36Rogue DHCP servers should not be a problem in any decently engineered enterprise or college campus network. Cisco switches have included DHCP snooping for years which when used only allows authorized switch ports to act as a DHCP server. Any decent enterprise wireless platform should either have transparent firewall functionality to block client DHCP responses or an equivalent to DHCP snooping.
If you've properly deployed these tools you've greatly limit the potential impact of a DHCP based worm.
Home router? Anyone test this against Linksys junk yet?
Re: Bash 'shellshock' bug is wormable
#37What about simply disabling CGI in Apache? If you're not using it, turn it off. Use "--disable-cgi" at Apache launch. This will break some "control panels", but you probably shouldn't be using a CGI-based control panel in 2014 anyway.
Re: Bash 'shellshock' bug is wormable
#38Earlier quoted context omitted.
This is a completely bonkers, Slammer-level hair-on-fire vulnerability. Remember Heartbleed? This is much worse. If you have a computer with an OS other than Windows or Android, your safest bet is to unplug it from the Internet until the bash developers figure this all out.
[deleted]
Android is not vulnerable. The person who posted a screenshot on twitter has bash installed on their phone. It is not in stock Android as far as I can tell, nor is it on my manually rooted Nexus 5. What the rooting tools install I don't know, it might include bash.
Re: Bash 'shellshock' bug is wormable
#39Test your local machine: export evil='() { :;}; echo vulnerable'; bash -c echo; Vulnerable computers will print 'vulnerable'. Test a CGI: curl -i -X HEAD " http://website" -A '() { :;}; echo "Warning: Server Vulnerable"' Vulnerable scripts will emit a "Warning" header. If you get a 405 error, try it with a GET request. I don't know the PoC fo new version which wiggles around the patch. I've tried the PoC on ksh, csh,…
Actually, the first test would be 'which bash', since not all systems have it installed by default.
Notably, FreeBSD, which has never included it by default.
Re: Bash 'shellshock' bug is wormable
#40What are the best OS-specific alternatives to bash, which could be linked to /bin/sh until bash fixes are stable?
On Debian /bin/sh is already provided by Dash