51–60 of 157 posts
Honest question: does this mean this vulnerability has been in bash for essentially its entire history and someone only discovered it now? Seems quite likely that someone would have discovered it sooner, especially since it's so simple to exploit.
Can anyone outline some clear steps for those of us on Debian Squeeze who have not yet got a patch?
Yes, you can switch to squeeze-lts and then update just bash. First, add the following two lines to your /etc/apt/sources.list: deb http://http.debian.net/debian/ squeeze-lts main contrib non-free deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free (you do not need to change or remove any other lines from sources.list). Then run the following command: apt-get update && apt-get install --only-upgr…
Test your local machine: export evil='() { :;}; echo vulnerable'; bash -c echo; Vulnerable computers will print 'vulnerable'. Test a CGI: curl -i -X HEAD " http://website" -A '() { :;}; echo "Warning: Server Vulnerable"' Vulnerable scripts will emit a "Warning" header. If you get a 405 error, try it with a GET request. I don't know the PoC fo new version which wiggles around the patch. I've tried the PoC on ksh, csh,…
bash: warning: evil: ignoring function definition attempt
bash: error importing function definition for `evil'
Test your local machine: export evil='() { :;}; echo vulnerable'; bash -c echo; Vulnerable computers will print 'vulnerable'. Test a CGI: curl -i -X HEAD " http://website" -A '() { :;}; echo "Warning: Server Vulnerable"' Vulnerable scripts will emit a "Warning" header. If you get a 405 error, try it with a GET request. I don't know the PoC fo new version which wiggles around the patch. I've tried the PoC on ksh, csh,…
so bash: warning: evil: ignoring function definition attempt bash: error importing function definition for `evil' would mean it's not?
Earlier quoted context omitted.
And my servers? Is there anything I can do without taking them offline?
Well, you could remove bash entirely (say, by replacing it with a link to dash). Doing this will likely break things, however, up to and including rendering the machine unbootable depending on which distribution it is and how the init scripts are written. You could replace bash with e.g. a perl script that strips parenthesis from your environment variables, and then invokes a differently named copy of bash. That migh…
Just did this, except I accidentally removed both bash and dash... it wasn't fun having to compile bash from source with zsh. For whatever reason it absolutely did not want to work.
But all back to normal now.
Yep. We're currently basically waiting to see which completes first: a) a patch for bash which actually works gets released and then trickles into the various ways to get it on every machine in the world or b) someone writes ~10 lines of payload code (download rootkit, execute, connect to IRC channel, join botnet, etc) and then just hits everything in IP4 space with a for loop. Optionally, the for loop gets distribut…
Logging into my server, things look good -- this is why you turn on automatic security updates. :)
Earlier quoted context omitted.
Any decent shell script is written to use "sh" not bash, and on debian/etc sh is provided by dash not bash. So while a lot of people are affected, your reasoning points to other issues that are very solveable
This more of a "should be", right? Maybe most shell scripts should use "sh" but I see "bash" way more often.
I specifically said any decent shell script. My logic is that if it is not using "sh", but instead relying on bash (or any other specific shell really), it's not a decent shell script.
If I were to amend the sentence to make the meaning clearer, I would still not use "should be", I would use "must be".
Earlier quoted context omitted.
Yes, you can switch to squeeze-lts and then update just bash. First, add the following two lines to your /etc/apt/sources.list: deb http://http.debian.net/debian/ squeeze-lts main contrib non-free deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free (you do not need to change or remove any other lines from sources.list). Then run the following command: apt-get update && apt-get install --only-upgr…
I just did this and got no upgrades.
Yep. We're currently basically waiting to see which completes first: a) a patch for bash which actually works gets released and then trickles into the various ways to get it on every machine in the world or b) someone writes ~10 lines of payload code (download rootkit, execute, connect to IRC channel, join botnet, etc) and then just hits everything in IP4 space with a for loop. Optionally, the for loop gets distribut…
Ubuntu 10.04LTS - 14.04LTS appears to be patched: http://www.ubuntu.com/usn/usn-2362-1/ Logging into my server, things look good -- this is why you turn on automatic security updates. :)
Although 7169 appears to be more difficult to exploit than 6271, you're not out of the woods until a patch gets distributed (+applied!) that covers both CVEs.
Earlier quoted context omitted.
I just did this and got no upgrades.
squeeze-lts is only available for i386 or amd64 architectures, I think, or you might be hitting an out-of-date mirror. You might try http://mirror.cc.columbia.edu/debian/ instead of http://http.debian.net/debian/