Earlier quoted context omitted.
Shameless plug as the owner: https://sysward.com/ - this is one of the reasons I built this - there is even a package view so you can apply just this package update across your systems. Message me if you have any questions!
I have a security warning from Chrome on my phone as of now. Maybe you want to look into that!
CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
31–40 of 226 posts
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#32Earlier quoted context omitted.
1. This exact bug, I dunno? From what I know about zsh, no, but what I don't know about zsh can fill books. But general string bugs? Probably. String processing is hard. 2. Possible yes, practical no (for most folks). Almost everybody's got a bunch of scripts with `#! /bin/bash` or `#! /usr/bin/env bash` lying around. Good luck excising everything that automatically assumes it's the shell of choice.
`ln -s /bin/zsh /bin/bash`?
Which would instantly break any script which uses bashisms.
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#33I'm starting to see automated attack attempts using HTTP_HOST headers set to '() {'.
Are you seeing any from IP addresses besides 209.126.230.72, which is Robert Graham scanning the Internet[1]? [1] http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-in...
My logs show 3 scans of this so far.
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#34Earlier quoted context omitted.
Shameless plug as the owner: https://sysward.com/ - this is one of the reasons I built this - there is even a package view so you can apply just this package update across your systems. Message me if you have any questions!
I have a security warning from Chrome on my phone as of now. Maybe you want to look into that!
Thanks for the heads up - I'll take a look!
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#35What tools are people using to track and push out security updates, if any? Right now I only have a few servers to administer so apticron is sufficient for notification and upgrading isn't a burden. Also, does anyone have a way to push out patched packages fast? Imagine that a patch is available, or it's trivial to remove a feature that you're not using, but the distribution hasn't made a package yet. I have been dre…
I typically use the CVE RSS feeds http://nvd.nist.gov/download/nvd-rss.xml and plug them into an IRC bot.
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#36Appears to work, even with latest patches, by using sh (from the link): $ env X='() { (a)=>\' sh -c "echo date"; cat echo date Wed Sep 24 15:00:34 PDT 2014 -- previous bug fix for bash (before/after patch) -- $ x='() { :;}; echo vulnerable' bash -c 'echo test' vulnerable test $ x='() { :;}; echo vulnerable' bash -c 'echo test' bash: warning: x: ignoring function definition attempt bash: error importing function defin…
[deleted]
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#37Another patch if cannot be bypassed: http://www.openwall.com/lists/oss-security/2014/09/25/10
Tried this patch on my system and was unable to get any of the latest PoC's to trigger the bug.
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#38Appears to work, even with latest patches, by using sh (from the link): $ env X='() { (a)=>\' sh -c "echo date"; cat echo date Wed Sep 24 15:00:34 PDT 2014 -- previous bug fix for bash (before/after patch) -- $ x='() { :;}; echo vulnerable' bash -c 'echo test' vulnerable test $ x='() { :;}; echo vulnerable' bash -c 'echo test' bash: warning: x: ignoring function definition attempt bash: error importing function defin…
[deleted]
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#39Welp, I'm about to take a hammer to all of my data centers and get busy, then move deep into the woods. Good luck to everybody else who decides to leave their equipment functioning; it was nice knowing you.
Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable
#40OK two questions: 1. Does zsh (or other shells) also have these kind of string processings where bugs are likely? 2. Is there a way to completely remove bash from the system and use zsh (or other shells) instead?
It really depends on the *nix you are running. FreeBSD, for example, only had bash as a port and it is not in the base install -- I believe `/bin/sh` is a derivative of ash[1]. [1]: http://en.wikipedia.org/wiki/Almquist_shell
I never really considered the importance of that. It always seemed like some weird crotchety UNIX thing to default to /bin/sh, and usually my first 30 minutes on a FreeBSD box are portsnapping, cd /usr/ports/shells/bash, and a make install clean.
Now I get it