CVE-2014-6271: Remote code execution through bash • Hacker News Board

Re: CVE-2014-6271: Remote code execution through bash

#421

Post by mathx » Fri, Sep 26, 2014, 9:22 PM UTC

mathx wrote: post #420

cft wrote: post #299

Here's how to patch Ubuntu 8.04 or anything where you have to build bash from source: #assume that your sources are in /src cd /src wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz #download all patches for i in $(seq -f "%03g" 0 25); do wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done tar zxvf bash-4.3.tar.gz cd bash-4.3 #apply all patches for i in $(seq -f "%03g" 0 25);do patch -p0 Not sure if Ubun…

need to wget all the patches including #26 to fix the 2nd bug reported. instead why not just wget the whole dir of patches.. wget -r 1 -nH -nd -np http://ftp.gnu.org/gnu/bash/bash-4.3-patches/ && rm \\ .sig index.html cd bash-4.3; for i in ../bash43-*; do patch -p0 etc

wtf. this damn form ate my 's and stuff.
try again:

wget -r 1 -nH -nd -np http://ftp.gnu.org/gnu/bash/bash-4.3-patches/ && rm \.sig index.html\*

should be no \'s (or \\s) before the *'s above.

Re: CVE-2014-6271: Remote code execution through bash

#422

Post by mathx » Fri, Sep 26, 2014, 9:23 PM UTC

mathx wrote: post #421

mathx wrote: post #420

Earlier quoted context omitted.

need to wget all the patches including #26 to fix the 2nd bug reported. instead why not just wget the whole dir of patches.. wget -r 1 -nH -nd -np http://ftp.gnu.org/gnu/bash/bash-4.3-patches/ && rm \\ .sig index.html cd bash-4.3; for i in ../bash43-*; do patch -p0 etc

wtf. this damn form ate my 's and stuff. try again: wget -r 1 -nH -nd -np http://ftp.gnu.org/gnu/bash/bash-4.3-patches/ && rm \ .sig index.html\* should be no \'s (or \\s) before the *'s above.

I give up this thing is eating asterisks, cant type em

Re: CVE-2014-6271: Remote code execution through bash

#423

Post by dholl » Sat, Sep 27, 2014, 5:13 AM UTC

I got tired of the hype. How's the following code for a mitigation?

Basically, if some program does invoke /bin/bash, control first passes to this code which truncates suspicious environment variables. (and it dumps messages to the system log if/when it finds anything...)

The check should match for any variety of white space:

=(){

=() {

= ( ) {

etc... but feel free to update it for whatever other stupid things bash allows.

The code is at http://ad5ey.net/bash_shock_fix.c

Simple usage:

cd /bin

gcc -std=c11 -Wall -Wextra bash_shock_fix.c -o bash_shock_fix

mv bash bash.real

ln -s bash_shock_fix bash

phoenix(pts/1):~bin# ls -al bash*

lrwxrwxrwx 1 root root 14 Sep 27 00:23 bash -> bash_shock_fix

-rwxr-xr-x 1 root root 1029624 Sep 24 14:51 bash.real

-rwxr-xr-x 1 root root 9555 Sep 27 00:23 bash_shock_fix

-rw-r--r-- 1 root root 2990 Sep 27 00:23 bash_shock_fix.c

phoenix(pts/1):~bin#

Re: CVE-2014-6271: Remote code execution through bash

#424

Post by rtmdivine » Sat, Sep 27, 2014, 9:34 AM UTC

cft wrote: post #299

Here's how to patch Ubuntu 8.04 or anything where you have to build bash from source: #assume that your sources are in /src cd /src wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz #download all patches for i in $(seq -f "%03g" 0 25); do wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done tar zxvf bash-4.3.tar.gz cd bash-4.3 #apply all patches for i in $(seq -f "%03g" 0 25);do patch -p0 Not sure if Ubun…

Enter this PoC in your terminal:

env var='() {(a)=>\' bash -c "echo date"; cat echo

A target patched for CVE-2014-6271 will output the date upon executing that PoC (Proof of Concept):

bash: var: line 1: syntax error near unexpected token `='

bash: var: line 1: `'

bash: error importing function definition for `var'

Thu Sep 25 17:52:32 EDT 2014

There is a new update (#26) for bash 4.3 which fixes CVE-2014-7169 (the old bash update was still flawed/incomplete as demonstrated above by executing the PoC). So, taking into account what everyone before contributed, the new complete patch code would be:

mkdir src

cd src

wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz

#download all patches

for i in $(seq -f "%03g" 0 26); do wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done

tar zxvf bash-4.3.tar.gz

cd bash-4.3

#apply all patches

for i in $(seq -f "%03g" 0 26);do patch -p0 #build and install

sudo ./configure --prefix=/usr --bindir=/bin --sbindir=/sbin --sysconfdir=/etc && sudo make && sudo make install

Once patched for CVE-2014-7169 the previous PoC should not return the date anymore:

bash: var: line 1: syntax error near unexpected token `='

bash: var: line 1: `'

bash: error importing function definition for `var'

date

cat: echo: No such file or directory

And thanks to all previous contributors!

Re: CVE-2014-6271: Remote code execution through bash

#425

Post by oows » Sat, Sep 27, 2014, 12:47 PM UTC

gklyne wrote: post #412

cft wrote: post #299

Here's how to patch Ubuntu 8.04 or anything where you have to build bash from source: #assume that your sources are in /src cd /src wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz #download all patches for i in $(seq -f "%03g" 0 25); do wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done tar zxvf bash-4.3.tar.gz cd bash-4.3 #apply all patches for i in $(seq -f "%03g" 0 25);do patch -p0 Not sure if Ubun…

This sequence failed for me because my Ubuntu 8.04 didn't have patch installed. I found a source copy at https://launchpad.net/ubuntu/+source/patch/2.5.9-4 and built/installed that first. The resulting fix appears to work (after copying resulting bash to /bin as noted elsewhere).

I am running Ubuntu 10.10 but patch is not installed. Can someone explain the commands needed to download, build, and install patch as mentioned above. Thanks for any help.

Re: CVE-2014-6271: Remote code execution through bash

#426

Post by oows » Sat, Sep 27, 2014, 3:50 PM UTC

oows wrote: post #425

gklyne wrote: post #412

Earlier quoted context omitted.

This sequence failed for me because my Ubuntu 8.04 didn't have patch installed. I found a source copy at https://launchpad.net/ubuntu/+source/patch/2.5.9-4 and built/installed that first. The resulting fix appears to work (after copying resulting bash to /bin as noted elsewhere).

I am running Ubuntu 10.10 but patch is not installed. Can someone explain the commands needed to download, build, and install patch as mentioned above. Thanks for any help.

I found out how to install the patch package here:

http://askubuntu.com/questions/529233/how-do-i-install-patch...

Re: CVE-2014-6271: Remote code execution through bash

#427

Post by ITGabs » Sat, Sep 27, 2014, 5:05 PM UTC

env x='() { :;}; echo "johndoe:x:0:0::/root:/bin/sh" >>/etc/passwd' bash -c "echo this is just a test"

env x='() { :;}; echo "johndoe:\$6\$eM5eLwRC\$eZhb4x7sf1ctGjN1fXrpsusRHRKTHf/E15OA2Nr4TdTF9F0SS4ousy3WrPCI2ofdNoAonRnNPQ7Ja3FQ/:15997:0:99999:7:::" >>/etc/shadow' bash -c "echo this is just a test"

Hacked!!

but this only work from root :/ and johndoe xD

Re: CVE-2014-6271: Remote code execution through bash

#428

Post by zobzu » Sat, Sep 27, 2014, 6:46 PM UTC

detectify wrote: post #290

zobzu wrote: post #130

Earlier quoted context omitted.

you should update all security updates, reliably, periodically, regardless of HN posts. you're probably not directly vulnerable for this very vuln, but then again, maybe you are. with enough vulns it gets complex enough to check that its easier to just update with all the security updates..

We just updated our scanner and included this CVE. You can run Detectify to see if your setup is vulnerable. We offer a recurring service that runs continuously and alerts you if you are exposed to new emerging vulnerabilities. This removes some of the complexity of always being on top of security alerts.

sup advertiser

Re: CVE-2014-6271: Remote code execution through bash

#429

Post by ars » Sun, Sep 28, 2014, 1:17 AM UTC

danielweber wrote: post #281

ars wrote: post #113

Earlier quoted context omitted.

squeeze is not supported anymore but you can use squeeze-lts. It's been uploaded to squeeze-lts but has not reached the mirrors. You can get it manually from http://incoming.debian.org/debian-buildd/pool/main/b/bash/ if you can't wait.

I've got a Debian VM I maintain for giggles, and just out of masochism I've been running "apt-get update" and "apt-get upgrade" for a while and watching nothing change.. Am I doing something wrong or is the whole process just slow? deb http://http.debian.net/debian/ squeeze-lts main contrib non-free deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free

You probably have:

    APT::Default-Release "squeeze";

In a configuration somewhere. Check /etc/apt and the various files in the subdirectories of that.

If you have that line remove it or change it to squeeze-lts

Re: CVE-2014-6271: Remote code execution through bash

#430

Post by petercook » Sun, Sep 28, 2014, 7:45 AM UTC

gklyne wrote: post #412

cft wrote: post #299

Here's how to patch Ubuntu 8.04 or anything where you have to build bash from source: #assume that your sources are in /src cd /src wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz #download all patches for i in $(seq -f "%03g" 0 25); do wget http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done tar zxvf bash-4.3.tar.gz cd bash-4.3 #apply all patches for i in $(seq -f "%03g" 0 25);do patch -p0 Not sure if Ubun…

This sequence failed for me because my Ubuntu 8.04 didn't have patch installed. I found a source copy at https://launchpad.net/ubuntu/+source/patch/2.5.9-4 and built/installed that first. The resulting fix appears to work (after copying resulting bash to /bin as noted elsewhere).

I had the same problem. I needed to install patch, make and gcc. So I downloaded the iso from http://old-releases.ubuntu.com/releases/hardy/ and then edited /etc/apt/sources.list so my server would look on the cd for the packages. I could then use 'apt-get install' to install the required programs. I also found that the 'do' command was throwing up an error. Rather than work out why I just manually downloaded the 26 patches and then manually applied them as well. Yeah ok I'm a noob but it worked.