Massive Bash Exploit

Rage9

Rage9

Banned
Jan 7, 2008
6,061
101
0
https://news.ycombinator.com/item?id=8361574

TLDR; There is a problem with the way the bash shell handles env variables and could lead to someone running exploit code on your system. If you have Linux servers you should drop whatever you are doing and patch immediately.

As many web masters here you probably want to make sure your servers are updated. Sounds pretty bad, some people saying it could be as bad as Heartbleed. If you have a linux server get yo shit updated ASAP!
 
  • Like
Reactions: cheshire


If you are responsible for the security of any system, this is your immediate, drop-everything priority. The technical details of the exploit mean that new ways of exploiting it will be discovered soon. Precedent suggests that automated systematic attacks against every server on the Internet will be coming, on a time scale of hours
Click to expand...
. holy fucking shit.
 
Thanks for the alert OP. While there's clearly some fearmongering in that ycombinator thread, my sysadmin had a close look and agrees this is a pretty nasty one that could indeed be as bad as heartbleed. Nice to have it all patched up early before the script kiddies start firing off exploits en masse.
 
As someone who shit his pants when I read this stuff. :thumbsup: Thumbs up for Wiredtree.
Yes, we are familiar with this. As soon as this attack hit CentOS mirrors, we rolled out a patch that now applies to the entire WiredTree network, and so we are safe from this attack.
Click to expand...


bro-hug-o.gif
 
Run following from the command prompt as root

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
Click to expand...

If you are vulnerable, you will see "vulnerable" being echoed on the screen.

I have an old version of ubuntu running on my server. Does anyone know if those repositories will get updated? Right now I don't see an update available
 
Doesn't the ssh vector rely on the attacker having valid credentials? And who the fuck builds a webapp that uses environment variables which are passed to bash? What's the use case?
 
Doesn't the ssh vector rely on the attacker having valid credentials?
Click to expand...

It seems that way, but there are cases like git, puppet, etc, that rely on ssh and it's ForceCommand parameter. This bug may let you escalate a "git only" account into running arbitrary commands.
 
Interesting, one of my servers on a managed plan was already patched but the other one wasn't. Now I know where I need to put a bit more attention to security
 
mattseh said:
Doesn't the ssh vector rely on the attacker having valid credentials? And who the fuck builds a webapp that uses environment variables which are passed to bash? What's the use case?
Click to expand...

this, i can't think of any attack vectors on my servers. it's not the 90s, i don't run any CGI scripts. gonna patch anyway obviously
 
mattseh said:
Doesn't the ssh vector rely on the attacker having valid credentials? And who the fuck builds a webapp that uses environment variables which are passed to bash? What's the use case?
Click to expand...

There are some obscure cases where people use CGI wrappers around PHP/Perl/Python, etc... These could potentially be exploited by headers.

Most systems should be fine though.
 
You must log in or register to reply here.
Top Bottom