Huge bash exploit CVE-2014-6271
 

https://web.nvd.nist.gov/view/vuln/d...=CVE-2014-6271

This is very easy to exploit and there will be a ton of hacked webservers among other things hacked in the next few weeks due to it. If you run a seedbox with certain settings there is a good chance you are vulnerable to this, it's not just an ssh issue. Also hardware with embedded linux may have issues. Also affects DHCP/network manager in some linux installs.

Various exploits are already out there and are so easy a 5 year old could do it.

It's bad.

Re: Huge bash exploit CVE-2014-6271
 

But they would still have to have some way to spawn a Bash shell in the first place (i.e. have shell access) right? Seeing as SSH won't execute any commands or even provide an environment prior to authentication... Yet the CVE says authentication not required.

[Edit]
Yep: " Regular use of OpenSSH is not affected because users already have shell access.". It's only if you limit shell access purely via executing a command in a shell, which isn't really a good way of doing it to begin with (Amazon uses it to prevent root access though).

Most embedded systems (well, all embedded systems I use) run a Busybox shell rather than Bash so it shouldn't be much of an issue there, mostly concerned about Apache + mod_cgi exploits. Especially if someone has a leaky php shell open.

Re: Huge bash exploit CVE-2014-6271
 

Don't need to already have shell access. You can do it through a a http request and spawn a remote shell.

Can also be abused via a rogue DHCP server to exploit some linux distros and also apple macs. It's not just mod_cgi.

Re: Huge bash exploit CVE-2014-6271
 

Does any of this have implications for us ordinary folks using PCs for a bit of surfing etc.? If so how and what, if anything, can we do about it? Presumably some of the sites we access might be vulnerable but how might that affect us? The brief BBC article on this mentioned home users looking out for device updates on things such as routers but how would we do this in practice and what devices are vulnerable?

TIA

Re: Huge bash exploit CVE-2014-6271
 

Guess that's another good example of why you should always run your web server processes in a deprivileged account...

Nonetheless the original source linked from your NIST article:

https://securityblog.redhat.com/2014...ection-attack/

says the vulnerability can be exploited via:

• Apache server using mod_cgi or mod_cgid are affected if CGI scripts are either written in bash, or spawn subshells. Such subshells are implicitly used by system/popen in C, by os.system/os.popen in Python, system/exec in PHP (when run in CGI mode), and open/system in Perl if a shell is used (which depends on the command string)

But:

• PHP scripts executed with mod_php are not affected even if they spawn subshells.

So I fail to see how else it could be exploited via HTTP, if your process can't execute or spawn shells to begin with...


Ah well, I guess I'll have to keep reading up on this... Makes my job fun.




---------- Post added at 13:57 ---------- Previous post was at 13:56 ----------

If you're running Windows, it will not affect you at all.

If you're running Mac or Linux but don't run any servers, you should be fine as long as attackers don't have direct physical access to your home network. On a public hotspot you might have to worry...

Re: Huge bash exploit CVE-2014-6271
 

Makes a change. ;)

TVM :tu:

Re: Huge bash exploit CVE-2014-6271
 

mod_php and mod_cgi are different :)

As you suggest, in many cases a privilege escalation exploit (ie kernel) will need to be used in conjunction to make proper use of it.

F5 Big IP firewalls have an issue with this but it appears you need access to the web interface to take advantage of it. https://twitter.com/securifybv/statu...172673/photo/1

---------- Post added at 15:07 ---------- Previous post was at 14:46 ----------

Already some infections due to this have been found. This exploit is used to download an ELF binary with a secondary exploit to get root privileges and then install DDoS software.

Re: Huge bash exploit CVE-2014-6271
 

Well it's certainly got people in a panic at work... Spent all day patching servers now I've got people writing in concerned that their desktops are 'vulnerable'

Re: Huge bash exploit CVE-2014-6271
 

You could be doing the same again tomorrow....it's looking like the patch doesn't actually fix it.

Re: Huge bash exploit CVE-2014-6271
 

Yeah I'm aware of that. Shouldn't really matter tomorrow. Everything's now either on auto-update or had Bash removed. Most systems already patched themselves at 6am this morning so whenever a 'proper' fix comes out I'd expect that to make it on there too.

Re: Huge bash exploit CVE-2014-6271
 

Yep. Ubuntu and Redhat both released fixes for the second bug around 6am this morning.

Re: Huge bash exploit CVE-2014-6271
 

Automatic updates in production environments :Sprint:

ISC has changed it's ThreatLevel/InfoCon to Yellow.

First link is a nice metasploit module which acts as a DHCP, infecting machines that ask for an IP. All you have to do is attach the machine with it running on to a networkk...

Some of the ITV link:

Re: Huge bash exploit CVE-2014-6271
 

Better than expecting end users to do their own updates.
Wouldn't work on a decent corporate network that had DHCP snooping active. Quite easily exploitable on public hotspots though. However people have said elsewhere OS X's DHCP implementation is not vulnerable, nor is Windows for obvious reasons leaving just the small minority of Linux desktops (most servers I know would be on static addressing anyway).

---------- Post added at 01:34 ---------- Previous post was at 01:28 ----------

* Although I know and have worked with a good number of corporate networks vulnerable to all sorts of DHCP based attack, if you can set up a rogue DHCP server you can already intercept and modify all (non SSL) traffic on that network anyway, which gives you a far wider range of machines and vulnerabilities to attack if you just wanted a botnet.

Re: Huge bash exploit CVE-2014-6271
 

Ubuntu sent a third patch out:

Re: Huge bash exploit CVE-2014-6271
 

Huh. Wonder when that came out, didn't get picked up by the auto-update this morning.