GNU/Linux, Open Source, Cloud Computing, DevOps and more...

Still unresolved Shellshock major vulnerability affecting Bash on Linux, Unix and MAC OS X

No comments

Less than two days after it was detected a vulnerability (CVE-2014-6271) that affects the Bash shell on Linux, Unix and Mac OS X, a patch was released that solves this issue only partially, which forced to report a new vulnerability (CVE-2014-7169) still pending. This issue has quickly gained a simple name by which it will be remembered for a long time: Shellshock or Shell Shock.

Background

The bug was detected by Stephane Chazelas, a Unix and Linux system administrator from Akamai when he found out that Bash erroneously interpreted as a command wich only was data within a variable when entering a specially crafted string in the command line. As a result, everything coming after that string was executed as a command or function by Bash. This allows any attacker to execute commands on your server arbitrarily. It’s true that this can not be done as root, but there are many harmful actions that can be done without root privileges.

Consecuences

Here are some of the most critical examples of attack vectors and systems that may be affected:

  • Apache: Apache servers, which are the most widespread of Internet web servers, may be affected if they use mod_cgi or mod_cgid if any of these scripts are written in Bash.
  • ForceCommand: this vulnerability can also be exploited to bypass ForceCommand in some sshd daemon implementations. It is supposed ForceCommand to limit remote code execution, but this bug allows to overcome this protection.
  • DHCP: the DHCP protocol that allows computers and devices on a network to automatically be assigned an IP address and other networking data is another service that could be affected according Red Hat. This is because this protocol allows DHCP servers passing environmental variables to its clients. An attacker could get those variables were interpreted as commands rather than as mere configuration data, which would allow to attack any computer on the network just by taking control of the DHCP server. This would be fatal in many cases, large companies for example.
  • SSH: other exploitable service is OpenSSH by using AcceptEnv, TERM and SSH_ORIGINAL_COMMAND variables. An environmental variable with an arbitrary name can include a nefarious function able to exploit the vulnerability and perform a remote attack through the network.
  • GIT: other services such as Git wich provides restricted shells could be affected by this vulnerability, as it would allow overcoming all that restrictions and take over the server.

Considering Bash is one of the most widely used command shells in the world, there is no doubt that more and more examples of other attack vectors will emerge in the coming days and weeks, so is essencial to fix this issue as soon as possible for all sysadmins with affected systems worldwide.

Diagnosis

To check if your Bash shell is vulnerable run these commands:

~$ env x='() { :;}; echo vulnerable' bash -c "echo Test 1"
~$ env X='() { (a)=>\' sh -c "echo vulnerable"; bash -c "echo Test 2"

If output of any of them (or both) displays the word vulnerable indeed your version of Bash is vulnerable:

~$ env x='() { :;}; echo vulnerable' bash -c "echo Test 1"
vulnerable
Test 1
~$ env X='() { (a)=>\' sh -c "echo vulnerable"; bash -c "echo Test 2"
vulnerable
Test 2

The patch can solve this issue must ensure that any command after the end of a function is not allowed. Therefore, if you execute the same command on a patched version of Bash you should get output like this:

~$ env x='() { :;}; echo vulnerable'  bash -c "echo Test 1"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
Test 1

Fix

If your system is vulnerable, the solution is to install the latest version of the Bash package, but as said earlier, this is only a partial solution. However Red Hat recommends to apply the patch that fixes the first vulnerability (CVE-2014-6271) in any case, as the second one (CVE-2014-7169) is not so severe:

Debian & Ubuntu
~# apt-get update && apt-get upgrade bash
Red Hat & CentOS
~# yum update bash

Links and further information

https://access.redhat.com/articles/1200223
https://access.redhat.com/articles/1212303
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169



 

About the author

Daniel López Azaña
Cloud Solutions Architect

Entrepreneur, a generator of ideas and restless mind. Passionate about new technologies, especially Linux systems and Open Source Software. I also like to write about Technology News, Cloud Computing, DevOps, System Security, Web Development and Programming, SEO, Science, Innovation, Entrepreneurship, etc.

DanielStill unresolved Shellshock major vulnerability affecting Bash on Linux, Unix and MAC OS X

Related Posts

Leave a Reply

Your email address will not be published. Required fields are marked *