Live data from Hacker News

CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

seclists.org

91–100 of 226 posts

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#91

Appears to work, even with latest patches, by using sh (from the link): $ env X='() { (a)=>\' sh -c "echo date"; cat echo date Wed Sep 24 15:00:34 PDT 2014 -- previous bug fix for bash (before/after patch) -- $ x='() { :;}; echo vulnerable' bash -c 'echo test' vulnerable test $ x='() { :;}; echo vulnerable' bash -c 'echo test' bash: warning: x: ignoring function definition attempt bash: error importing function defin…

I don't think either you or the author are correct. hobbes@media:~$ env X='() { (a)=>\' sh -c "echo date"; cat echo date cat: echo: No such file or directory hobbes@media:~$ uname -a Linux media 3.13-1-686-pae #1 SMP Debian 3.13.5-1 hobbes@media:~$ echo $BASH_VERSION 4.3.25(1)-release It looks to me like we're setting X in the environment, calling `sh -c "echo date"`, passing that X in to it, nothing happens, then we…

The above one didn't work for me either (it never created the file) but the example someone gave below where it's split up worked for me.

run

export X="() { (a)=>\\"

now run

bash -c 'echo date'

Now under no normal circumstances should i have a file named echo in my current directory. But i do!

In fact once that environment variable is set everytime i run bash -c 'XXXX date' i end up with a file named XXXX in my current directory. There's no way that should be happening.

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#92

With the patched bash, if you run env X='() { (a)=>\' sh -c "echo date" This is equivalent to running date >echo That is, you can put something in the environment which causes it to drop the first token, run the result as a command, and redirect the result to the dropped first token. An example of a context where this would be exploitable, is a CGI webapp which accepts an uploaded zip file, stores it in a FAT filesys…

Hm. On one hand, this is pretty specific and not "run into the woods" dangerous. On the other hand, it's also not that unrealistic. Also, I am kind of afraid there will be more stuff lurking in there.

It's almost like the shell was designed to execute arbitrary commands!

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#93
post #70
post #21

What tools are people using to track and push out security updates, if any? Right now I only have a few servers to administer so apticron is sufficient for notification and upgrading isn't a burden. Also, does anyone have a way to push out patched packages fast? Imagine that a patch is available, or it's trivial to remove a feature that you're not using, but the distribution hasn't made a package yet. I have been dre…

Since I'm an Ubuntu user, I use Landscape to keep my system up-to-date: https://landscape.canonical.com/ It did the patching for me during the night (I told it to do so for security updates), so I woke up to already patched systems. Full disclaimer: I work for Canonical.

I have no interest in paying for Ubuntu Advantage. I would happily pay a reasonable amount for just Landscape, but Canonical doesn't offer that. Get your sales guys to fix that, and you'll end up with a lot more Landscape users. Or better yet, just open source Landscape.

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#94
post #88

The exploit worked against my cgi perl scripts as well! I had cgi-bin/update.pl running on OS X and I exploited it as mentioned here: https://twitter.com/hernano/status/514866681530023936 My perl scripts call $out = `git pull`, log to a file, and print a response; I was quite surprised the exploit worked against them. Promptly disabled, upgraded bash, and re-enabled, now disabling all cgi for a bit longer. What are t…

Perl backticks and system() delegate commands to the system shell, normally sh. On many systems, sh is simply bash in compatibility mode. That's how the attacker gets at the vulnerability.

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#95
post #89
post #70

Earlier quoted context omitted.

Since I'm an Ubuntu user, I use Landscape to keep my system up-to-date: https://landscape.canonical.com/ It did the patching for me during the night (I told it to do so for security updates), so I woke up to already patched systems. Full disclaimer: I work for Canonical.

How much does Landscape cost? I honestly can't figure it out. The only thing I saw was ~$300 per server... most of my servers didn't cost anywhere near $300...

You can't buy Landscape directly, sadly... You have to pay for Ubuntu Advantage, which is their support offering, which is why it's a ridiculous $$$ per server.

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#96
I found some exploitprobes from a server called datacards.org. Happend on a server located in germany. Its some kind of personal data gathering system (National Defense University DataCards)

http://home.comcast.net/~dshartley3/DIMEPMESIIGroup/Data.htm http://discussions.sisostds.org/threadview.aspx?threadid=533...

Should be limited to Afganistan and stuff

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#98
post #88

The exploit worked against my cgi perl scripts as well! I had cgi-bin/update.pl running on OS X and I exploited it as mentioned here: https://twitter.com/hernano/status/514866681530023936 My perl scripts call $out = `git pull`, log to a file, and print a response; I was quite surprised the exploit worked against them. Promptly disabled, upgraded bash, and re-enabled, now disabling all cgi for a bit longer. What are t…

Perl backticks and system() delegate commands to the system shell, normally sh. On many systems, sh is simply bash in compatibility mode. That's how the attacker gets at the vulnerability.

Thanks. Suspected as much, but still a bit petrified that the shell var/func passed through perl to the backtick-shell.

Re: CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

#100
post #90
post #88

The exploit worked against my cgi perl scripts as well! I had cgi-bin/update.pl running on OS X and I exploited it as mentioned here: https://twitter.com/hernano/status/514866681530023936 My perl scripts call $out = `git pull`, log to a file, and print a response; I was quite surprised the exploit worked against them. Promptly disabled, upgraded bash, and re-enabled, now disabling all cgi for a bit longer. What are t…

Not sure if it helps against this vulnerability, but using Git::Wrapper [1] makes for much nicer code than backticks. [1] https://metacpan.org/pod/Git::Wrapper

Awesome, thanks. Seems like it would've.
Post reply on HN