Shellshock - Remote code execution via Bash

Scuzz

Not sure if this has been posted as my unread list on shows a few items even though it has 20+ in the icon (@psychobunny @julian @baris ??)

I'm not sure if many of you are aware but there has been a serious vulnerability found with Bash that will execute commands on a server via anything that uses system calls.

Detailed information

Everyone should update Bash as soon as possible. The recent patch is not a full patch for this vulnerability but it will help.

? Offline

For those running Ubuntu:

Test if vulnerable:
$ env var='() { ignore this;}; echo uhoh' bash -c /bin/true

If you get a response of uhoh you're vulnerable.

Here's the steps to patch:
apt-get update
apt-get install bash
$ env var='() { ignore this;}; echo uhoh' bash -c /bin/true (Retest)

You should now get something along the lines of:

bash: warning: var: ignoring function definition attempt
bash: error importing function definition for 'var'

Patch success.

a_5mith

For those that don't understand the issue. Another from my favourite Tom Scott

? Offline

Thanks to @a_5mith, I just binged several of his videos. He does a good job of breaking things down for those with little experience, when he isn't doing something humorous. Thanks for sharing this.

a_5mith

@Ted said:

Thanks to @a_5mith, I just binged several of his videos. He does a good job of breaking things down for those with little experience, when he isn't doing something humorous. Thanks for sharing this.

He does a few videos for Computerphile as well. Where he goes into a little more detail. Does some really good videos.

julian

If you're running Ubuntu 13.10, you're SOL. I've received no updates fixing this. As bad as it sounds, if you're running 13.10, UPGRADE TO 14.04!

fuzzmz

@julian alternatively recompile Bash by hand. This should work:

mkdir src
cd src
wget http://ftp.gnu.org/gnu/bash/bash-4.3.tar.gz
#download all patches
for i in $(seq -f "%03g" 0 28); do wget     http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-$i; done
tar zxvf bash-4.3.tar.gz 
cd bash-4.3
#apply all patches
for i in $(seq -f "%03g" 0 28);do patch -p0 < ../bash43-$i; done
#build and install
./configure && make && make install
cd .. 
cd ..
rm -r src

Please note thought that a full patch for the exploit is not yet available.

julian

All NodeBB servers have been updated and patched against Shellshock.

Scuzz

@julian I am on Ubuntu 12 LTS and received the updates for bash. They may not have been out at the time you checked for 13?

I checked my logs and we only had a couple of attempts against our server, luckily I had updated when the quick fix got released and updated again when the actual fix was released.

fuzzmz

@Scuzz, the main problem is that the issue hasn't been completely fixed. As far as I know the latest patch for bash 4.3 is 28 which makes things safer, but still not completely impenetrable.

Scuzz

@fuzzmz I know they released a quick fix but after that I thought they released another that completely fixed it?

I had updates for bash twice over the last week or so.

julian

@Scuzz If you have LTS, then you're fine, but 13.10 only had 9 months' of support, which ended in July. Unfortunate for us, the majority of our servers were 13.10

They're all running 14.04 now, and won't change for awhile yet.