401–410 of 432 posts
Earlier quoted context omitted.
I finally understand how it can be used.
I'm sorry; perhaps I'm slow. I see the problem, but how can a stranger set an environment variable?
#include
#include
int main()
{
setenv("VAR", "() { :;}; echo vulnerable", 0);
system("ls");
#./a.out
vulnerable
a.out
#
Earlier quoted context omitted.
I'm a relative newcomer to the command line and have been Googling around for what exactly the () {:;} is doing with no luck. Does anyone have a good link or explanation?
() makes a function { is the function body : is an ancient 'command' that does nothing ; is says run the : command } closes the function body.
Earlier quoted context omitted.
So, as a amateur sysadmin of a decently popular side project, what should I do? I've read over the post on the mailing list, and I think I understand the basic attack, but I'm having trouble understanding exactly how an attacker could run bash on my server and what I therefore need to patch (though I suspect that's intentional). Is `sudo apt-get update && sudo apt-get upgrade` sufficient on an Ubuntu server?
If you're still waiting for mirrors and such to sync, you can install these packages manually on the LTS releases with the snippet here: http://hastebin.com/oraheyipug.hs
Here's how to patch Ubuntu 8.04 or anything where you have to build bash from source: #assume that your sources are in /src cd /src wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz #download all patches for i in $(seq -f "%03g" 0 25); do wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done tar zxvf bash-4.3.tar.gz cd bash-4.3 #apply all patches for i in $(seq -f "%03g" 0 25);do patch -p0 Not sure if Ubun…
sudo make install
Given the circumstances, a lot of people without much software experience will be reading this message and simply copying and pasting; it's worth getting it right.
On Ubuntu, you'll probably want to ./configure --prefix=/usr/bin . If you install in /usr/local/bin (the default), bash will effectively no longer be updated by apt-get.
Earlier quoted context omitted.
> OpenSSH, that sets ORIG_SSH_COMMAND variable to the command that the user supplies // So they set shell vars without sanitising them first?
As an analogy, suppose I go to a website written in PHP and register with the username "Robert'); DROP TABLE Students;--". A correct PHP script will sanitize the name; it'll escape the quote and run something like `update users set name='Robert\'); DROP TABLE Students;--'`. If mysql then ignores the backslash and drops the Students table, that is definitely a mysql problem and not a PHP problem. Doing any more on the…
:)
Here's how to patch Ubuntu 8.04 or anything where you have to build bash from source: #assume that your sources are in /src cd /src wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz #download all patches for i in $(seq -f "%03g" 0 25); do wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done tar zxvf bash-4.3.tar.gz cd bash-4.3 #apply all patches for i in $(seq -f "%03g" 0 25);do patch -p0 Not sure if Ubun…
Earlier quoted context omitted.
Surely though the CGI framework sanitises the headers first? Otherwise this seems like it's a pretty predictable problem - isn't "always sanitise user data" the cardinal rule of backends. I can certainly imagine that I might have designed a web page that passed user input direct to a BASH script to do a ping or some such, but not if it's public facing.
What sanitization do you expect the CGI framework to apply to the header value representing the user agent? str_replace($userAgent, '() {', 'no bash bug for you')? Only a few environment variables are given any meaning by the system. Other environment variables don't have any predefined meaning and can be any null-terminated string.
It seems like a sort of loose typing issue. Perhaps if when setting environment variables the app using them could specify a type (eg nonExecutableText) such that bash knows it's receiving textual content that mustn't be executed; would that help?
Here's how to patch Ubuntu 8.04 or anything where you have to build bash from source: #assume that your sources are in /src cd /src wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz #download all patches for i in $(seq -f "%03g" 0 25); do wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done tar zxvf bash-4.3.tar.gz cd bash-4.3 #apply all patches for i in $(seq -f "%03g" 0 25);do patch -p0 Not sure if Ubun…
This won't work; you need sudo make install Given the circumstances, a lot of people without much software experience will be reading this message and simply copying and pasting; it's worth getting it right. On Ubuntu, you'll probably want to ./configure --prefix=/usr/bin . If you install in /usr/local/bin (the default), bash will effectively no longer be updated by apt-get.
Once upon a time, distributions documented their build configurations. Or maybe it's that I used to only use FreeBSD.
Earlier quoted context omitted.
http://www.ubuntu.com/usn/usn-2362-1/ Ubuntu 14.04 LTS: bash 4.3-7ubuntu1.1 Ubuntu 12.04 LTS: bash 4.2-2ubuntu2.2 Ubuntu 10.04 LTS: bash 4.1-2ubuntu3.1 For releases in-between, you should be able to manually download one of those versions from http://archive.ubuntu.com/ubuntu/pool/main/b/bash/ and install it. I wonder how many vulnerable boxes there are that won't get these updates because Ubuntu stops support after…
It's for that reason that I just ignore anything that's not an LTS release. It's never worth the hassle for me.
Earlier quoted context omitted.
https://launchpad.net/ubuntu/+source/bash/4.3-7ubuntu1.1 seems to be at least one version of the fix, I'm unsure about LTS and other releases.
http://www.ubuntu.com/usn/usn-2362-1/ Ubuntu 14.04 LTS: bash 4.3-7ubuntu1.1 Ubuntu 12.04 LTS: bash 4.2-2ubuntu2.2 Ubuntu 10.04 LTS: bash 4.1-2ubuntu3.1 For releases in-between, you should be able to manually download one of those versions from http://archive.ubuntu.com/ubuntu/pool/main/b/bash/ and install it. I wonder how many vulnerable boxes there are that won't get these updates because Ubuntu stops support after…
----------------------------------------------------------
amd64
wget archive.ubuntu.com/ubuntu/pool/main/b/bash/bash_4.2-2ubuntu2.3_amd64.deb
sudo dpkg -i bash_4.2-2ubuntu2.3_amd64.deb
----------------------------------------------------------
i386
wget archive.ubuntu.com/ubuntu/pool/main/b/bash/bash_4.2-2ubuntu2.3_i386.deb
sudo dpkg -i bash_4.2-2ubuntu2.3_i386.deb