Linux 'shellshock' update your bash or get owned

[stonith3901]

If you are using Linux it probably has the 'bash' shell package installed. If not then don't worry. If it does, this has been rated a severity 10. Granted most of these are Redhat specific, as that is what I use:

https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271

https://bugzilla.redhat.com/show_bug.cgi?id=1141597

Here is the solutions page:

https://access.redhat.com/solutions/1207723

This vulnerability is probably just as bad as Heartbleed if not worse. Update your systems with the latest updates on bash for your particular flavor.

[yellowsulphur]

Thanks for the info and I just updated my personal cloud server to the latest version. Although I don't consider myself a big target I use Fedora and have ssh open to the outside.

[pbsmind]

Shellshock wont be as wide spread as heartbleed. To exploit remotely you'll need public services that access bash environment variables. Like passing the user agent as an environment variable. Hopefully you're not running these services as root.

Also affects OSX since it uses bash.

Easy test to see if you were vulnerable.

This flaw is triggered when extra code is added to the end of these function definitions (inside the enivronment variable). Something like:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test

The patch used to fix this flaw, ensures that no code is allowed after the end of a bash function. So if you run the above example with the patched version of bash, you should get an output similar to:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test

[Jscanlan]

Additional Info

Ubuntu is vulnerable. Go to :

http://askubuntu.com/questions/528101/what-is-the-cve-2014-6271-bash-vulnerability-and-how-do-i-fix-it

To find the info to patch the vulnerability

[elSquid]

Also affects OSX since it uses bash.

Yup.

On my 10.9.5 MacMini:

~$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test


-- Michael

[Cowboy T]

Yep. This isn't a "Linux bug" like some of the press have tried to claim. It's not even a Red Hat bug. It's a shell bug, specific to the Bourne-Again SHell (BASH). That means it could also show up on Free/Net/OpenBSD if you run BASH there, too.

Furthermore, if you happen to be running BASH on a Microsoft platform (one example would be Cygwin), then you're also vulnerable, depending on what else you're running.

Get those systems patched! Mine are already done.

[skunkbad]

Yes, it's not just Linux, but pretty much any OS with a Unix core, because nearly all of them will have bash. I think the media is downplaying the effect on Mac OSX for whatever reason. Ubuntu had a update to bash last night, and another today. I think most linux geeks will be on top of their updates. Mac OSX people range from geeks to old grannies, so they may suffer more. I have 3 linux machines and one Mac, all updated immediately. Makes me glad I have 5 windows computers, just in case ...

[yellowsulphur]

Yep. This isn't a "Linux bug" like some of the press have tried to claim. It's not even a Red Hat bug. It's a shell bug, specific to the Bourne-Again SHell (BASH). That means it could also show up on Free/Net/OpenBSD if you run BASH there, too.

Furthermore, if you happen to be running BASH on a Microsoft platform (one example would be Cygwin), then you're also vulnerable, depending on what else you're running.

Get those systems patched! Mine are already done.

Totally true. For some reason I thought some of the more well known distros out there were running Zsh.

[the86d]

Nice, THX for the test line.

I updated before I even looked for a test and since there was an update I was patched before this thread dropped. I don't keep up on things like I once did, scouring forums and such, but then again I don't have default ports opened like I used to.

[ocabj]

This isn't a Linux bug. It's a bug that affects anything that can run bash. This includes Oracle Solaris, FreeBSD, OpenBSD, Linux, OS X, Cygwin for Windows, etc. Don't look at bugs as OS specific. bash is an application. It's an application bug. If your OS can run that application, you need to check to see if that application is installed and test it.

Plus, OS'es don't have to 'run' bash. Quite a few Linux distributions have multiple shells installed (e.g. sh, bash, tcsh, ksh). They don't all 'run'. The shell is only run when something invokes it, whether it's your local console login, remote console (tty?), ssh, cgi via httpd, or even a system call in a php script.

And note, the patches that were released prior to 2014-09-26 0000Z are not complete. If you check your email or secfeeds, you'll see that RHEL has another bash update that addresses the incomplete fix from the initial bash code patches.

It was discovered shortly after the first bash update post CVE-2014-6271 that there are still environment variable exploits and resulted in CVE-2014-7169.

https://rhn.redhat.com/errata/RHSA-2014-1306.html

Redhat might be releasing the bash updates in their upstreams slightly faster than other distros simply because many bash developers work for Redhat.

What you guys also need to do is restart any daemons that have the ability to spawn bash (e.g. openssh, apache via cgi) or flat out reboot your boxes after you update bash (either through packages or source compile). Even after you update your bash binaries, it's still possible that the previous bash version is loaded in memory by another daemon such as openssh, leaving it network vulnerable.

[ocabj]

Yes, it's not just Linux, but pretty much any OS with a Unix core, because nearly all of them will have bash. I think the media is downplaying the effect on Mac OSX for whatever reason. Ubuntu had a update to bash last night, and another today. I think most linux geeks will be on top of their updates. Mac OSX people range from geeks to old grannies, so they may suffer more. I have 3 linux machines and one Mac, all updated immediately. Makes me glad I have 5 windows computers, just in case ...

If you want to talk about being downplayed, you need to look at Solaris. They still haven't released a patch. We've had to compile and deploy updated bash for both Sparc and X86 for three different Solaris versions (via puppet).

As far as my Macs, I only run OS X on my laptop/desktops which don't have open attack vectors to utilize the bash exploit.

[yellowsulphur]

Ocabj, you're right. Updated yesterday and there is another update today.

[stonith3901]

ugh again!

Ocabj, you're right. Updated yesterday and there is another update today.

Yeah came here to say this. There is a second update in regards to this:

https://access.redhat.com/articles/1200223

Red Hat has been made aware of a vulnerability affecting all versions of the bash package as shipped with Red Hat products. This vulnerability CVE-2014-6271 could allow for arbitrary code execution. Certain services and applications allow remote unauthenticated attackers to provide environment variables, allowing them to exploit this issue.

Update: 2014-09-26 05:15 UTC

Red Hat has become aware that the patch for CVE-2014-6271 is incomplete. An attacker can provide specially-crafted environment variables containing arbitrary commands that will be executed on vulnerable systems under certain conditions. The new issue has been assigned CVE-2014-7169.

https://access.redhat.com/security/cve/CVE-2014-6271

https://access.redhat.com/security/cve/CVE-2014-7169

[Cowboy T]

Yes, it's not just Linux, but pretty much any OS with a Unix core, because nearly all of them will have bash. I think the media is downplaying the effect on Mac OSX for whatever reason.

Probably because the media folks are still being affected by the Jobsian "Reality Distortion Field" which says that anything Apple must be like manna from the heavens and thus already perfect. That's a dangerous attitude for them to have, because people might get bitten. There are folks who do run Mac OS X as a Web server platform, for example.

Makes me glad I have 5 windows computers, just in case ...

If your Windows computers have bash (e. g. Services for UNIX or Cygwin), then they're vulnerable, too.

[ocabj]

I haven't gotten around to writing any OSSEC rules to check for shellshock attempts against my personal webhosts.

We have bro rules on the work NIDS that detect for specific http headers attempting to probe and/or obtain a shell through the shellshock exploit.

But since I need something for my personal HIDS applications, I need to leverage an OSSEC rule + active response rule with Apache logs.