Shellshock [vulnerability with Bash]

[Fzero]

Posting this as affects Linux too

http://www.bbc.co.uk/news/technology-29361794

 

[levi]

The Pandora's version of bash is vulnerable to this, although I don't fully understand how this can be exploited yet.  Very few people are likely to be running Apache on their Pandora, but sshd is apparently vulnerable, so if you have enabled dropbear and are connecting to random wifi routers, you are at risk AIUI.  You might even be at risk at home as your router might be vulnerable via similar mechanisms.

Edit: I can't figure out how to exploit this via sshd without having a valid login, unlike Apache which can apparently be made to invoke bash without authentication.  I may be wrong though, as I've only just found out about this, and assuming you're connected to a hacked router, it's presumably possible for that to be brute-forcing all your computers in the background.

It may be worth looking into one of the approaches to stop dictionary attacks in your sshd config.

 

[elwing]

interesting vulnerability names...

 

[Fzero]

I see recommendation of deploying the patch immediately... but cannot see any link/info to the patch in question.

Please add to here if/when you guys get detail on what we should do to patch this, I have my Pandora and also a Mac ... and lots and lots of pr0n on both* which need protecting from malicious hax0r types

* [SIZE=13.8181819915771px]not really, but I do have lots of data I wouldn't want some joker to just delete for his or her lulz[/SIZE]

 

[levi]

The redhat securityblog report after bring down for the past hour or so is back and worth checking.  I won't link to it just yet though, until it looks like it can handle the traffic.

We need to check if DHCP on the Pandora is vulnerable.  It's starting to look like the Pandora's relatively safe unless something knows or can force your ssh login or keys. but DHCP is one we do use.

If a mod can move this thread somewhere on-topic it would probably be for the best.  There do appear to be issues for Pandora users here.

 

[moxie]

Automatic message

This topic has been moved from "Off topic → Offtopic General talk" to "Pandora → General Talk".

 

[Magic Sam]

Hi,

The patch for Debian is here:

Spoiler

*** ../bash-20140912/parse.y    2014-08-26 15:09:42.000000000 -0400
--- parse.y    2014-09-24 22:47:28.000000000 -0400
***************
*** 2959,2962 ****
--- 2959,2964 ----
word_desc_to_read = (WORD_DESC *)NULL;

+ eol_ungetc_lookahead = 0;
+
current_token = '\n';        /* XXX */
last_read_token = '\n';

I hope this can be used as a starting point to patch the bash version we have on the Pandora.

Cheers, Magic Sam

 

[levi]

And here (I think) is the GNU bash change that fixes it: http://git.savannah.gnu.org/cgit/bash.git/commit/?id=b64a0e1d0b412cedda763a32d6e5cd6927333f02


At least, it's the latest change on their master branch, and it looks to be changing stuff in the area concerned. Unfortunately, the change description isn't very helpful, but it's the first change for a week, so it's almost certainly related.

 

[Magic Sam]

@ Levi: +1 for your patch Same author as the one I found, but looks much more relevant.

Cheers, Magic Sam

 

[Cloudef]

This security bug has blown out of proportions and is not actually even serious than people make it up to be.

It mainly gained fame by somebody scanning internet for computers and found about 1000 systems executing bash remotely and getting env variables from HTTP headers.

If you run sane stuff, this most likely does not affect you.

Though it's still a bug that should be fixed, just not a _serious_ one.

 

[sepulep]

I think it could be serious, most worrying for normal users is that DHCP clients can be fooled by malicious hotspots in running code with root privileges, although I think for pandora bash is not the default shell, so that might safe us..

 

[FIQ]

The default Pandora shell is sh, not bash, except for your own user (by default).

 

[notaz]

Yeah I don't see a way to exploit this on a pandora, unless you run apache serving shell-based cgi scripts, but even those would have to explicitly set their interpreter to /bin/bash , as /bin/sh points to busybox, a mentioned. dhclient also doesn't run any bash scripts.

But in case it saves anyone some sleep (for me it doesn't), patched bash is now in the feeds. At least the updated version also brings in a bunch of bugfixes, which might be useful.

Edit: forgot to say that the media is blowing this bug out of proportion, it's as if some Microsoft marketing guys were behind it to get more market share for their Windows systems, which get exploits of similar level on a weekly basis.. The bug only affects very limited kind of systems; it's not that common to serve web pages or other content through shell scripts, doing things like that is not very efficient or useful.

 

[klapse]

At a company I worked for there were some shell scripts invoked by webserver. But for linux boxes without remote shell execution there is no remote bash exploit, AFAIU.

 

[Fzero]

So for me, probably not too much to worry about then, I don't think I run such shell based CGI scripts myself...


Where is 'in the feeds' though? If I wanted to patch it anyway? Or is that just info for devs really? [Hence I don't know what that means]


Also for OS X users, reckon its nothing to worry about until Apple roll out an update in due course then, for pretty lightweight use like myself?


I could leave it switched off for the while, or if not that much a threat I'll continue using it. I pretty much only use it for Photoshop, FTP filezilla, offline gaming, Plex media server... And of course web browsing

 

[notaz]

Where is 'in the feeds' though? If I wanted to patch it anyway? Or is that just info for devs really? [Hence I don't know what that means]

The feeds, or http://openpandora.org/feeds/ is where "System->Upgrade pandora OS" picks all updates from.

 

[Fzero]

Ah OK thanks, I check for updates now and then so will run that again tomorrow now

 

[levi]

Edit: forgot to say that the media is blowing this bug out of proportion

Yeah, I got a little panicked earlier, not much information about and lots of pretty core software getting mentioned. I doubt anyone much has been using this bug in the years it was unfixed in secret, except in a few specific cases I guess, as to use it widely means someone checking their logs might notice something fishy which to the best of my knowledge, they haven't. And even if the stars align and one of the attack vectors works on a specific box, boxes are already getting patched at a rate of knots.

 

[mongrol]

Here's info on the DHCP exploit for this but if SZ links /bin/sh to busybox we're probably cool to keep using Starbucks.

https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/

 

[sepulep]

from the ISC dhcp changelog:

- A change to the linux client script to use /bin/bash, since /bin/sh may
not be bash.

:angry:

now checking dhclient-script shows:


#!/bin/sh

so we are good afterall... -_-

btw there is a nice disclaimer in the script from the ISC source (which indeed uses bash hardcoded):


#!/bin/bash
# dhclient-script for Linux. Dan Halbert, March, 1997.
# Updated for Linux 2.[12] by Brian J. Murrell, January 1999.
# No guarantees about this. I'm a novice at the details of Linux
# networking.

novice?    more like an undercover NSA type... h34r: