Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bash 'shellshock' bug is wormable

blog.erratasec.com

Post reply on HN
Print view View original

81–90 of 157 posts

Re: Bash 'shellshock' bug is wormable

#81

Post by regularfry »

f00ber wrote: post #69

Oh stop this stupidity already. If you are not running a Web server that spawns bash when serving an HTTP request, then you are NOT vulnerable. Are you running a Web server that uses CGI scripts written in shell or plain C that uses system() call? If you do, you have had other problems long before. There are some grumblings about DHCP _client_ setups on Linux passing parameters via environment variables to shell scri…

Forgive me if I've misunderstood the problem, but isn't, for instance, a perl cgi script which happens to shell out to bash for some incidental functionality also vulnerable? The environment variable should get inherited.

Re: Bash 'shellshock' bug is wormable

#82

Post by bodyfour »

f00ber wrote: post #69

Oh stop this stupidity already. If you are not running a Web server that spawns bash when serving an HTTP request, then you are NOT vulnerable. Are you running a Web server that uses CGI scripts written in shell or plain C that uses system() call? If you do, you have had other problems long before. There are some grumblings about DHCP _client_ setups on Linux passing parameters via environment variables to shell scri…

> plain C that uses system() call?

Lots of code uses system()/popen() etc. If no user-controlled input is passed in as an argument, most people would have not considered that a potential vulnerability. More software than you think is going to be affected.

Re: Bash 'shellshock' bug is wormable

#83

Post by _xnmw »

patio11 wrote: post #2

Yep. We're currently basically waiting to see which completes first: a) a patch for bash which actually works gets released and then trickles into the various ways to get it on every machine in the world or b) someone writes ~10 lines of payload code (download rootkit, execute, connect to IRC channel, join botnet, etc) and then just hits everything in IP4 space with a for loop. Optionally, the for loop gets distribut…

What about using the exploit to remotely patch machines?

Re: Bash 'shellshock' bug is wormable

#84

Post by bodyfour »

patio11 wrote: post #2

Yep. We're currently basically waiting to see which completes first: a) a patch for bash which actually works gets released and then trickles into the various ways to get it on every machine in the world or b) someone writes ~10 lines of payload code (download rootkit, execute, connect to IRC channel, join botnet, etc) and then just hits everything in IP4 space with a for loop. Optionally, the for loop gets distribut…

It won't be as simple as scanning all IP4 space because for most vulnerable hosts you still will need to know a URL of a cgi program that can cause bash to be executed (either because they're written in shell or, more likely, that there is some path found that can cause popen()/system()/etc to be called) If you read Robert Graham's blog post about his scan for this (posted to HN earlier today) he mentioned that the hosts he found by just looking at the root URL are probably a tiny subset of what's really out there.

What we'll probably see is lots of blackhats looking at common CGI-based packages, finding a way to provoke an exploit using that, and then doing an IPv4 scan exploiting just that one. There will also be a long-tail of people mounting more directed attacks against URLs they suspect are CGI based.

Re: Bash 'shellshock' bug is wormable

#85

Post by sjy »

TheSoftwareGuy wrote: post #3

I didn't realize iOS and OS X DHCP could be vulnerable. This just went from "Man a lot of other people should be worried about this" to "shit, shit, shit, shit, shit", since I don't run a web server.

Have you got a source for OS X DHCP being vulnerable? OS X has a copy of bash at /bin/sh so it's pretty vulnerable if you can find a way to remotely set environment variables and call system().

Re: Bash 'shellshock' bug is wormable

#86

Post by justincormack »

LeoPanthera wrote: post #8
tdicola wrote: post #7

As someone who just runs an Ubuntu 14.04 desktop machine without any web server should I be concerned? I don't really see how anyone could remotely execute bash on my system.

It's hard, but not impossible. Apparently your DHCP client passes responses from the DHCP server to bash. Let's say, for the sake of argument, that your ISP's DHCP server is compromised. A worm could then spread to your system from it. This is entirely hypothetical, but not impossible.

to bash? or to /bin/sh? Or the user shell? On Ubuntu you are fine unless it explicitly calls bash or (unlikely) uses the user shell.

Re: Bash 'shellshock' bug is wormable

#87

Post by thaumaturgy »

lemming wrote: post #60
thaumaturgy wrote: post #58

Earlier quoted context omitted.

squeeze-lts is only available for i386 or amd64 architectures, I think, or you might be hitting an out-of-date mirror. You might try http://mirror.cc.columbia.edu/debian/ instead of http://http.debian.net/debian/

Using Columbia didn't help either. Using uname -m shows x86_64 so I guess that's it. I'll just have to wait for another update.

Silly question, but did you use sudo for the apt-get? I forget to do that sometimes. Because I'm a bit stumped why you're not getting the update, you should be.

Re: Bash 'shellshock' bug is wormable

#89

Post by pbhjpbhj »

LeoPanthera wrote: post #8
tdicola wrote: post #7

As someone who just runs an Ubuntu 14.04 desktop machine without any web server should I be concerned? I don't really see how anyone could remotely execute bash on my system.

It's hard, but not impossible. Apparently your DHCP client passes responses from the DHCP server to bash. Let's say, for the sake of argument, that your ISP's DHCP server is compromised. A worm could then spread to your system from it. This is entirely hypothetical, but not impossible.

What responses does it pass, does it not sanitise them? Can anyone link to details of what DHCP does that's relevant here? Thanks.

Re: Bash 'shellshock' bug is wormable

#90

Post by ams6110 »

berkut wrote: post #61
yoha wrote: post #54

Earlier quoted context omitted.

That's the message you get on a patched machine. However, the patch is not sufficient: https://news.ycombinator.com/item?id=8365216 .

Or an earlier version of bash (4.1), which I'm assuming (haven't installed any patches within the last month on a centOS6 machine) hasn't got the issue?

It has, there is a patch for bash 4.1

ftp://ftp.gnu.org/pub/gnu/bash/bash-4.1-patches/bash41-012

Post reply on HN