391–400 of 432 posts
Interestingly enough ancient BASH version 3.2 on Mac OS X 10.9.5 is not vulnerable: $ echo $BASH_VERSION 3.2.51(1)-release $ x='() { :;}; echo vulnerable' bash -c "echo this is a test" bash: warning: x: ignoring function definition attempt bash: error importing function definition for `x' this is a test $ I manually patched my BASH 4.3 to patch level 25 so it's not vulnerable either. $ echo $BASH_VERSION 4.3.25(1)-re…
Earlier quoted context omitted.
Fortunately they are unlikely to install bash at all on a router.
Routers definitely have shells, it's just a matter of whether it's bash or something else that might also be vulnerable.
so basically turn off AcceptEnv in sshd_config?
I don't think so. From what I've been reading it can be exploited via http requests. I'm sure a metasploit script is right around the corner. Edit: oh looks like only like mod_cgi related stuff is.. thats good then sort of
mod_cgi is just one of the most obvious attack vectors.
Earlier quoted context omitted.
It doesn't have a nice catchy name and a logo, though
Fine. Now it's called BashSmash. Are you happy? Go make a logo.
That's nice. I like this song.
Earlier quoted context omitted.
Fine. Now it's called BashSmash. Are you happy? Go make a logo.
People are now calling it "Shellshock". That's nice. I like this song. https://www.youtube.com/watch?v=2pWZRJd4z8o
My OSX Mavericks install appears to be affected: foom:~ steve$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" vulnerable this is a test
Doesn't OSX ship the 8-year-old bash 3.2 (2006) i.e. the last version available as GPLv2? (Apple hates GPLv3)
Please feedback here: https://news.ycombinator.com/item?id=8366643
Earlier quoted context omitted.
You're correct – you'd need to overwrite /bin/bash (think long and hard about this) to update it before Apple ships an update. The good news is that as long as you're not running a local server, the vulnerability is pretty limited particularly since even if you did have SSH enabled the exploit would require valid authentication first.
There's some potentially funky stuff there like CUPS, which runs a local daemon that serves binary CGIs (though I think it's bound to localhost by default). http://support.apple.com/kb/HT4169 Might be wise to turn all network-listening services off that you don't immediately need until a fix is available.
I would go further and suggest that now is an excellent time to ask which of those services you really need to have at all. The default of blocking incoming connections is right for most people, even developers.
Here's how to patch Ubuntu 8.04 or anything where you have to build bash from source: #assume that your sources are in /src cd /src wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz #download all patches for i in $(seq -f "%03g" 0 25); do wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done tar zxvf bash-4.3.tar.gz cd bash-4.3 #apply all patches for i in $(seq -f "%03g" 0 25);do patch -p0 Not sure if Ubun…
# bash --version
bash --version
GNU bash, version 4.2.45(1)-release (x86_64-pc-linux-gnu)