381–390 of 432 posts
I tested some of the sites and successfully executed some test code. One can easily google for such sites. The important thing is that, the link using which I ran the code is of a .gov site. This thing seriously needs to be patched asap. Update your systems now.
Earlier quoted context omitted.
> Is `sudo apt-get update && sudo apt-get upgrade` sufficient on an Ubuntu server? Yes. Patch is out.
I am on linode and precise LTS. I did this, and I got no bash update. What am I doing wrong? edit: and how do I know if I am still vulnerable? edit2: ok, this is the test env x='() { :;}; echo vulnerable' bash -c "echo this is a test" and apparently I am already patched. So that's good.
WIll tell you which version of bash is installed, for precise you should have bash 4.2-2ubuntu2.2
Am I wrong in thinking that seems a bit worse than Heartbleed?
The exploit is worse. But I'm not sure how a scanner bot would find network accessible bashes to exploit. Seems like basically you need a cgi-bin with bash, and I don't think there's any way to predict a URL that is going to have such a thing. Now, if there is some popular app that ends up vulnerable (perhaps because it shells out to bash), then that's definitely going to be huge. But as it is... I'm not sure?
I write hundreds of shell scripts per year and I never, ever use bash. Everything can be done with a less complex /bin/sh having only POSIX-like features.
There's no reason webservers have to use bash by default.
Sysadmins might need a hefty shell will lots of features in order to do their work, but an httpd should not need access to bash-isms. It should work fine with a very minimal POSIX-like shell.
I'm glad the systems I use do not have bash installed by default. The only time I ever use it is when a software author tries to force me to use bash by writing their install scripts in it and using bash-isms so the script will not run with a simpler shell like a BSD /bin/sh.
% E='() { echo hi; }; echo cry' bash -c 'echo "-$E-"'
bash: warning: E: ignoring function definition attempt
bash: error importing function definition for `E'
--
In fact, if I wanted my variable to be a function, why wouldn't I just explicitly eval it? What's the use case at all for this functionality?
Amazon's Linux distro for EC2 is still waiting for a patch. EDIT: Finally got things updated. Bulletin can be found here: https://alas.aws.amazon.com/ALAS-2014-418.html If yum isn't finding the update, try running "yum clean all" and then "yum update bash"
Still waiting for a fix on Beanstalk. Neither "yum clean all" followed by "yum update bash" nor "yum --releasever=2014.09 update bash" currently work. EDIT: relevant AWS threads https://forums.aws.amazon.com/thread.jspa?threadID=161489 https://forums.aws.amazon.com/thread.jspa?threadID=161529&ts...
To manually update EC2 instances managed by Elastic Beanstalk, you can run the following command:
For Amazon Linux 2013.09 "sudo yum install -y http://packages.us-east-1.amazonaws.com/2013.09/updates/556c...
For Amazon Linux 2014.03 "sudo yum install -y http://packages.us-east-1.amazonaws.com/2014.03/updates/e10f...
Earlier quoted context omitted.
If you just want to update that package then: apt-get update apt-get install --only-upgrade bash fwiw, Linode's mirrors are up with the latest version yet Digital Ocean's are not. I lose faith in DO everytime I remote into my VM. They just seen like an amateurish shop.
My droplets in SFO have been updated. My droplets in nyc1 and nyc2 haven't.
Earlier quoted context omitted.
Because this allows execution of arbitrary commands from any unsantized environment variable. Web servers pass information about the HTTP client to CGI scripts using environment variables. A CGI script written in bash would be vulnerable to arbitrary command execution if any HTTP header contained the vulnerable string. GET / HTTP/1.0 User-Agent: () { :; }; rm -rf / Restricted SSH accounts (like the ones used by GitHu…
Who the hell writes CGI scripts in 2014? There is a reason PHP is to be kept away and not touched with a ten meter stick, it seems to spawn a shell for weird reasons, I dont think python or groovy apps do that. They're safe, unless you somewhere specifically invoke System.getRuntime().run("bash");
That's a one-liner in Groovy, written in the Java style of chained method calls, which is the direct equivalent of spawning a shell in non-JVM languages, so that's not an argument for using Groovy instead of PHP.
According to http://wiki.bash-hackers.org/syntax/basicgrammar it appears that this is because bash allows functions to be exported through environment variables into subprocesses, but the code to parse those function definitions seems to be the same used to parse regular commands (and thus execute them). Edit: after a brief glance over the affected code, this might not be so easy to patch completely - the actual meth…
EDIT: Apparently that's out of the question, but there's talk about using a BASH_FUNCDEFS variable to specify which variables are function definitions instead: http://www.openwall.com/lists/oss-security/2014/09/24/20
Free BashBleed logo for tech journalists - http://i.imgur.com/ilJbM74.png