Shellshock *nix Vulnerability

[I-Hate-Hulse]

Wow - another massive vulnerability in the supposedly more secure *nix and OSX operating systems... Patch, Patch, Patch folks.... Amazing that this vulberability could have existed for 25 years....

A bug discovered in the widely used Bash command interpreter poses a critical security risk to Unix and Linux systems – and, thanks to their ubiquity, the internet at large.

It lands countless websites, servers, PCs, OS X Macs, various home routers, and more, in danger of hijacking by hackers.

The vulnerability is present in Bash up to and including version 4.3, and was discovered by Stephane Chazelas. It puts Apache web servers, in particular, at risk of compromise: CGI scripts that use or invoke Bash in any way – including any child processes spawned by the scripts – are vulnerable to remote-code injection. OpenSSH and some DHCP clients are also affected on machines that use Bash.

Ubuntu and other Debian-derived systems that use Dash exclusively are not at risk – Dash isn't vulnerable, but busted versions of Bash may well be present on the systems anyway. It's essential you check the shell interpreters you're using, and any Bash packages you have installed, and patch if necessary.

http://www.theregister.co.uk/2014/09...sh_shell_vuln/

It's definately not everyday you can say this:

“The only people who don’t have to worry about it are people who are running Windows consumers PCs or devices that are smaller than five centimetres by five centimetres,” Prof. Skillicorn said.

“Absolutely everything in between is almost certainly affected.”

http://www.theglobeandmail.com/techn...board/follows/

[rbochan]

What? No waiting for Patch Tuesday?!?!?

[FlameOn]

Thank goodness this was discovered earlier and people can do something about it. Heartbleed it was more people found out about it after the fact it had already been widely exploited no?

As far as I can tell, this would affect everything including routers, web servers and all sorts of networking equipment that used embedded linux/Unix as well. Hopefully everything gets patched pretty quick but there will always be private things or companies with lazy/oblivious employees.

I really wonder if this is one of those "NSA purposely left wide open exploits" that someone just happened to discover now.

[Barnes]

Most Mac OS X (and probably Linux users) aren't affected unless they've enabled some Unix services.

You can run this in the Terminal to check:

env x='() { :ignored function;}; echo this should not show' bash

You would also have to be running some sort of software that can be run over the Internet and can invoke Bash when run.

Server owners should be worried. Home users not so much.

[Resolute 14]

Originally Posted by FlameOn

Thank goodness this was discovered earlier and people can do something about it. Heartbleed it was more people found out about it after the fact it had already been widely exploited no?

As far as I can tell, this would affect everything including routers, web servers and all sorts of networking equipment that used embedded linux/Unix as well. Hopefully everything gets patched pretty quick but there will always be private things or companies with lazy/oblivious employees.

I really wonder if this is one of those "NSA purposely left wide open exploits" that someone just happened to discover now.

The problem with shellshock isn't so much that it was caught before widespread exploitation, but in the fact that it is an exploit of ancient code within Bash that related to features nobody even really uses. So far, there are at least four separate CVE articles assigned to various aspects of this - they patched for one test case, then discovered another, and another, and another...

So now we probably have a race between security researchers and "hackers" to find other exploits in ancient code. It's almost looking like fighting a hydra. Cut off one head, discover another.

As an aside, I am loving the fact that Windows PCs are unaffected, but Macs have some risk. Minimal as it is, there are people freaking out because Apple doesn't have a patch yet.

[Barnes]

Apple has released a security update for Lion, Mountain Lion, and Mavericks.

[Resolute 14]

Ugh. Of all the reasons I hate Apple, the need to always refer to each revision of OSX by its codename is near the top.

[OldDutch]

Originally Posted by Resolute 14

Ugh. Of all the reasons I hate Apple, the need to always refer to each revision of OSX by its codename is near the top.

You mean like:

Cupcake (1.5)
Donut (1.6)
Eclair (2.0–2.1)
Froyo (2.2–2.2.3)
Gingerbread (2.3–2.3.7)
Honeycomb (3.0–3.2.6)
Ice Cream Sandwich (4.0–4.0.4)
Jelly Bean (4.1–4.3.1)
KitKat (4.4–4.4.4)

[Barnes]

Originally Posted by Resolute 14

Ugh. Of all the reasons I hate Apple, the need to always refer to each revision of OSX by its codename is near the top.

That's a strange thing to hate. You should see someone about that.

[photon]

http://www.fireeye.com/blog/technica...istrators.html

Might want to disable remote access to your NAS.

[I-Hate-Hulse]

Synology NASs are not affected, but will patch anyways.

http://www.wegotserved.com/2014/09/3...-dsm-software/

[Resolute 14]

Originally Posted by Barnes

That's a strange thing to hate. You should see someone about that.

Its more of the same pretentious nonsense Apple is known for, and just as stupid in Android. Just dumb that I have to cross reference what version number a computer is giving me against a list of random cat names to figure out which patch to apply.

[Barnes]

Originally Posted by Resolute 14

Its more of the same pretentious nonsense Apple is known for, and just as stupid in Android. Just dumb that I have to cross reference what version number a computer is giving me against a list of random cat names to figure out which patch to apply.

Oh? I just click app store and then update.

Its users who started using codenames to refer to versions because they were always announced at WWDC which is where developers are who tend to use codenames. OSX has wine based codenames internally. It's not new, unique, or pretentious.

My favorite was Capone (System 7.5) because he ruled Chicago (Windows 95).