Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bash 'shellshock' bug is wormable

blog.erratasec.com

Post reply on HN
Print view View original

41–50 of 157 posts

Re: Bash 'shellshock' bug is wormable

#41

Post by stephenr »

inportb wrote: post #29
cperciva wrote: post #18

Earlier quoted context omitted.

I run no Linux/Unix/MacOS/compatible/etc machine which connects other machines How about "I don't run bash"? There are other perfectly good shells, you know...

I suspect that many folks who "don't run bash" actually do use bash quite a bit, e.g. in initscripts and various software packages.

Any decent shell script is written to use "sh" not bash, and on debian/etc sh is provided by dash not bash.

So while a lot of people are affected, your reasoning points to other issues that are very solveable

Re: Bash 'shellshock' bug is wormable

#43

Post by zaroth »

Shellshock is a perfect name coming after Heartbleed. But this bug is suffering from lack of marketing, lagging in the news behind the iOS update being pulled.

It's sad to see an RCE somewhere so widespread and so interwoven with other software. It's also costly because now I'm questioning server integrity, thinking about what should really be re-imaged. I assume there are many more like this in the CVE pipeline...

At some point I just have to live with the fact that outside access is possible to anyone so motivated.

Re: Bash 'shellshock' bug is wormable

#45

Post by thaumaturgy »

deanclatworthy wrote: post #42

Can anyone outline some clear steps for those of us on Debian Squeeze who have not yet got a patch?

Yes, you can switch to squeeze-lts and then update just bash. First, add the following two lines to your /etc/apt/sources.list:

    deb http://http.debian.net/debian/ squeeze-lts main contrib non-free
    deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free
(you do not need to change or remove any other lines from sources.list).

Then run the following command:

    apt-get update && apt-get install --only-upgrade bash
...which will update your apt sources (but not your installed software) and then will upgrade bash and only bash.

Re: Bash 'shellshock' bug is wormable

#46

Post by deanclatworthy »

thaumaturgy wrote: post #45
deanclatworthy wrote: post #42

Can anyone outline some clear steps for those of us on Debian Squeeze who have not yet got a patch?

Yes, you can switch to squeeze-lts and then update just bash. First, add the following two lines to your /etc/apt/sources.list: deb http://http.debian.net/debian/ squeeze-lts main contrib non-free deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free (you do not need to change or remove any other lines from sources.list). Then run the following command: apt-get update && apt-get install --only-upgr…

Thank you. This worked.

Re: Bash 'shellshock' bug is wormable

#47

Post by prawn »

zaroth wrote: post #43

Shellshock is a perfect name coming after Heartbleed. But this bug is suffering from lack of marketing, lagging in the news behind the iOS update being pulled. It's sad to see an RCE somewhere so widespread and so interwoven with other software. It's also costly because now I'm questioning server integrity, thinking about what should really be re-imaged. I assume there are many more like this in the CVE pipeline... A…

Front page of the site of one of the major Australian newspapers: "Largest bug ever hits the internet"

I think it will start to make its way out to the public with a bit more time.

Re: Bash 'shellshock' bug is wormable

#49

Post by zaroth »

prawn wrote: post #47
zaroth wrote: post #43

Shellshock is a perfect name coming after Heartbleed. But this bug is suffering from lack of marketing, lagging in the news behind the iOS update being pulled. It's sad to see an RCE somewhere so widespread and so interwoven with other software. It's also costly because now I'm questioning server integrity, thinking about what should really be re-imaged. I assume there are many more like this in the CVE pipeline... A…

Front page of the site of one of the major Australian newspapers: "Largest bug ever hits the internet" I think it will start to make its way out to the public with a bit more time.

I'm sure they've picked up now that the patch was bad. Should be an interesting day.

Wow the comments there are...

Re: Bash 'shellshock' bug is wormable

#50

Post by erikb »

stephenr wrote: post #41
inportb wrote: post #29

Earlier quoted context omitted.

I suspect that many folks who "don't run bash" actually do use bash quite a bit, e.g. in initscripts and various software packages.

Any decent shell script is written to use "sh" not bash, and on debian/etc sh is provided by dash not bash. So while a lot of people are affected, your reasoning points to other issues that are very solveable

This more of a "should be", right? Maybe most shell scripts should use "sh" but I see "bash" way more often.
Post reply on HN