Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bash 'shellshock' bug is wormable

blog.erratasec.com

Post reply on HN
Print view View original

71–80 of 157 posts

Re: Bash 'shellshock' bug is wormable

#71

Post by f00ber »

Oh stop this stupidity already. If you are not running a Web server that spawns bash when serving an HTTP request, then you are NOT vulnerable.

Are you running a Web server that uses CGI scripts written in shell or plain C that uses system() call? If you do, you have had other problems long before.

There are some grumblings about DHCP _client_ setups on Linux passing parameters via environment variables to shell scripts executed by bash, but I am yet to see this. This would be a problem, but probably easily fixable.

No need to panic or even patch anything (as always). If you running servers on your machine and allow inbound connections you should know exactly what those servers are and what they execute on behalf of external users.

This is NOT remotely exploitable.

It's an ad campaign for "security researchers" people.

Re: Bash 'shellshock' bug is wormable

#73

Post by bodyfour »

berkut wrote: post #61
yoha wrote: post #54

Earlier quoted context omitted.

That's the message you get on a patched machine. However, the patch is not sufficient: https://news.ycombinator.com/item?id=8365216 .

Or an earlier version of bash (4.1), which I'm assuming (haven't installed any patches within the last month on a centOS6 machine) hasn't got the issue?

If you see that "ignoring function definition attempt" message you definitely have the first patch applied (but not necessarily a fix for the second problem) That diagnositc was added by the patch itself. See http://ftp.gnu.org/pub/gnu/bash/bash-4.1-patches/bash41-012

Maybe you have auto-update turned on and didn't realize it?

Re: Bash 'shellshock' bug is wormable

#74

Post by josteink »

yoha wrote: post #54
valamit wrote: post #53

Earlier quoted context omitted.

so bash: warning: evil: ignoring function definition attempt bash: error importing function definition for `evil' would mean it's not?

That's the message you get on a patched machine. However, the patch is not sufficient: https://news.ycombinator.com/item?id=8365216 .

So from what I can tell, neither my Raspbian or Ubuntu setups have this second vulnerability properly patched yet (although they have the first one).

I guess I'll just have to wait until it becomes available. They're usually pretty responsive about issues like this.

Re: Bash 'shellshock' bug is wormable

#75

Post by bodyfour »

dustingetz wrote: post #21

I have a macbookpro which is my developer workstation. It is in a default configuration, it is on 12 hours a day, always behind a NAT. What do I need to do to protect myself?

Just apply the security updates as they arrive from Apple. The highest-risk activities like running a webserver hosting CGI scripts isn't likely to apply to you. I can't say for certain nobody will find a clever client-side attack for OS/X but right now you don't need to join in the panic that many sysadmins are (rightly) feeling today.

Re: Bash 'shellshock' bug is wormable

#76

Post by clarry »

f00ber wrote: post #69

Oh stop this stupidity already. If you are not running a Web server that spawns bash when serving an HTTP request, then you are NOT vulnerable. Are you running a Web server that uses CGI scripts written in shell or plain C that uses system() call? If you do, you have had other problems long before. There are some grumblings about DHCP _client_ setups on Linux passing parameters via environment variables to shell scri…

It is hilarious that you claim this is not remotely exploitable in response to a post describing how a very simple and limited scan has already found thousands of vulnerable hosts in a short timeframe.

And I dare say there are lots of admins who do not know exactly what their servers are going to execute because they're using software written by other people. That's why we call them admins, not software developers.

By the way, system() can be used in quite a lot of languages, not just in plain C.

And there are definitely more attack vectors than CGI. CGI is just the most obvious one.

Re: Bash 'shellshock' bug is wormable

#77

Post by bodyfour »

fabulist wrote: post #22
hackcasual wrote: post #6

Earlier quoted context omitted.

I think you need that + the ability to add anything to an environment variable. Not sure how easy that is. edit: reading this looks like its exploiting CGI scripts, presumeably through the host header

Setting an environment variable is often pretty easy, but the Host: header is the wrong way to go. The webserver will usually ignore a bad Host: header. User-agent: is much more availing.

CGI will typically pass most any header along as a HTTP_headername environment variable (HTTP_HOST is just one example) I'd expect most malicious exploiters to use a non-standard header, since User-Agent's value is often logged.

Re: Bash 'shellshock' bug is wormable

#78

Post by bodyfour »

timv wrote: post #63
zaroth wrote: post #49

Earlier quoted context omitted.

I'm sure they've picked up now that the patch was bad. Should be an interesting day. Wow the comments there are...

If your conclusion that the patch was bad is based on the fact that CVE-2014-7169 still exists, I think that's an unfair assessment. The patch appears to have been a adequate fix to the bug that was discovered. The fact there is a second bug with a similar but not-identical attack vector, is a reflection on the robustness/correctness of the original code more than it is a reflection on the quality of the patch.

... and also a reflection of how much security attention this one obscure feature has been receiving in the last 24 hours.

This is very similar to the pattern we saw with heartbleed: a terrible bug with a lot of publicity followed by a series of other vulnerabilities found of various severity as suddenly it was "all eyes on OpenSSL": http://www.openssl.org/news/secadv_20140806.txt

I wouldn't be surprised if we're going to see a repeat of that here.

Re: Bash 'shellshock' bug is wormable

#79

Post by stripe »

f00ber wrote: post #69

Oh stop this stupidity already. If you are not running a Web server that spawns bash when serving an HTTP request, then you are NOT vulnerable. Are you running a Web server that uses CGI scripts written in shell or plain C that uses system() call? If you do, you have had other problems long before. There are some grumblings about DHCP _client_ setups on Linux passing parameters via environment variables to shell scri…

Then this might be news to you:

https://gist.github.com/anonymous/929d622f3b36b00c0be1

Re: Bash 'shellshock' bug is wormable

#80

Post by stephenr »

yen223 wrote: post #66
stephenr wrote: post #57

Earlier quoted context omitted.

I guess it comes down to how you interpret things. I specifically said any decent shell script. My logic is that if it is not using "sh", but instead relying on bash (or any other specific shell really), it's not a decent shell script. If I were to amend the sentence to make the meaning clearer, I would still not use "should be", I would use "must be".

If you can confidently assert that every shell script your system runs is "decent", then you'll have no problem. The thing is, very few of us can confidently make that assertion.

That all depends where your shell scripts come from.

In my experience most of the shell scripts provided by packages for debian, do use /bin/sh.

A quick check of .sh files on a couple of squeeze/wheezy installs showed that the vast majority of shell scripts using Bash come from node modules, which quite frankly is not surprising.

Post reply on HN