Live data from Hacker News

CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

seclists.org

81–90 of 226 posts

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#81
post #77

Can someone explain why bash is evaluating and looking for function definitions in every environment variable? What would be broken if this entire "feature", whatever it is, was completely disabled? That's almost like a C compiler looking for C programs in string literals. It just doesn't make sense to me.

It's so you can export a function into child shells:

http://stackoverflow.com/questions/1885871/exporting-a-funct...

Hardly worth the security cost in retrospect, but some bash scripts will surely break if it were just ripped out.

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#82
Proposed patch for CVE-2014-7169 here:

http://www.openwall.com/lists/oss-security/2014/09/25/10

I am building bash updates for Ubuntu containing the proposed fix here and will publish them once the fix has been made official:

https://launchpad.net/~ubuntu-security-proposed/+archive/ubu...

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#83

I run an Ubuntu server in my closet as a general-purpose file server and such, mostly just for my own use or for sending files to friends. I have just turned it off and disabled all port forwards to it, and I will wait at least a few days and check for a more definitive fix before opening it back up to the internet. I recommend anyone in a similar situation do the same.

The only attack vectors I've seen so far are:

* webservers that are configured to run things via the ancient CGI interface. There are lots of these on the internet (so that's bad) but most OSes aren't going to be vulnerable out of the box or anything. Also, the biggest risk is if you're on a server where /bin/sh is bash, which is not the case for Ubuntu.

* people using sshd and have users that are allowed to ssh but not run a shell -- for instance by having "command=" settings in a .ssh/authorized_keys file. Most people won't have this. It's a pattern most associated with services like github which allows you to use git-over-ssh but not run arbitrary programs on their servers. Another example would be if you've set up a special key for a backup system to connect over ssh and run rsync. Most servers aren't going to have these things. If you're just using sshd for normal user logins there is no impact: you can "exploit" the bug and run arbitrary commands, but only if you have the same credentials you could have used to log in and run them yourself anyway.

* DHCP clients could be affected, but only if the server is already compromised (or spoofed) which probably isn't a huge concern for your home network.

So you're probably overreacting here. Certainly stay up-to-date on the patches as they come out for safety, though.

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#85

OK - so assuming that there isn't going to be a single patch which fixes all possible / related bugs any time soon. Options? - Change /bin/sh to something else. (CentOS has BASH as default, alas...) - Filter out unknown, or suspicious looking HTTP vars / env vars at varnish/apache/nginx level, somehow... (doesn't stop other services) - Figure out some clever SELinux configuration that blocks it. I wonder how much wou…

[deleted]

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#86
post #84

Another PoC: env -i X='() { (a)=>\' bash -c 'echo curl -s https://bugzilla.redhat.com/ '; head echo Creates file called echo and outputs the contents using head. (from https://bugzilla.redhat.com/show_bug.cgi?id=1141597#c24 )

[deleted]

You might want to make sure the symlink is really in effect -- try temporarily deleting bash or making is non-executable:

# chmod -x `which bash`

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#87
post #70
post #21

What tools are people using to track and push out security updates, if any? Right now I only have a few servers to administer so apticron is sufficient for notification and upgrading isn't a burden. Also, does anyone have a way to push out patched packages fast? Imagine that a patch is available, or it's trivial to remove a feature that you're not using, but the distribution hasn't made a package yet. I have been dre…

Since I'm an Ubuntu user, I use Landscape to keep my system up-to-date: https://landscape.canonical.com/ It did the patching for me during the night (I told it to do so for security updates), so I woke up to already patched systems. Full disclaimer: I work for Canonical.

When Landscape would be cheaper I would try to using it aswell, but since it's not I'm using ansible.

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#88
The exploit worked against my cgi perl scripts as well!

I had cgi-bin/update.pl running on OS X and I exploited it as mentioned here: https://twitter.com/hernano/status/514866681530023936

My perl scripts call $out = `git pull`, log to a file, and print a response; I was quite surprised the exploit worked against them. Promptly disabled, upgraded bash, and re-enabled, now disabling all cgi for a bit longer.

What are the common vectors beyond CGI-space for the average server? How do we find and test them?

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#89
post #70
post #21

What tools are people using to track and push out security updates, if any? Right now I only have a few servers to administer so apticron is sufficient for notification and upgrading isn't a burden. Also, does anyone have a way to push out patched packages fast? Imagine that a patch is available, or it's trivial to remove a feature that you're not using, but the distribution hasn't made a package yet. I have been dre…

Since I'm an Ubuntu user, I use Landscape to keep my system up-to-date: https://landscape.canonical.com/ It did the patching for me during the night (I told it to do so for security updates), so I woke up to already patched systems. Full disclaimer: I work for Canonical.

How much does Landscape cost? I honestly can't figure it out.

The only thing I saw was ~$300 per server... most of my servers didn't cost anywhere near $300...

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#90
post #88

The exploit worked against my cgi perl scripts as well! I had cgi-bin/update.pl running on OS X and I exploited it as mentioned here: https://twitter.com/hernano/status/514866681530023936 My perl scripts call $out = `git pull`, log to a file, and print a response; I was quite surprised the exploit worked against them. Promptly disabled, upgraded bash, and re-enabled, now disabling all cgi for a bit longer. What are t…

Not sure if it helps against this vulnerability, but using Git::Wrapper [1] makes for much nicer code than backticks.

[1] https://metacpan.org/pod/Git::Wrapper

Post reply on HN