• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Pretty major Linux exploit with Bash

Red Squirrel

Red Squirrel

No Lifer
http://seclists.org/oss-sec/2014/q3/649

Patch up ASAP.

This is probably worse than Heartbleed.

Basically remote code can be executed via various services such as apache due to a bash exploit.

Embargo period was today so this info is fresh and there may be more info that comes out to public. Best to patch before that point.
 
Reading various comments on various news sites its funny how people are saying "i thought open source didn't have these problems"

The general public seem to forget that the point of more eyes on the code is to actually find these problems 🙂.
 
Got the patch in Debian testing today. If you want to see if you're patched or not, paste this in your shell...

Code: 
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
 
Nice! Was wondering what was a good way to do within the OS. My public facing server is not vulnerable, my home ones are, but not that concerned at this point as they're not public facing. I'll still be doing updates though.
 
Stock android uses a different shell. Unless you're rooted and have bash explicitly installed, you most likely don't have it but it depends on the developer. I think Cyanogenmod makes use of bash.
 
IGemini said:
Stock android uses a different shell. Unless you're rooted and have bash explicitly installed, you most likely don't have it but it depends on the developer. I think Cyanogenmod makes use of bash.
Click to expand...

Thanks, good to know. It's moto G and nexus 7 so should be stock android.
 
IGemini said:
Stock android uses a different shell. Unless you're rooted and have bash explicitly installed, you most likely don't have it but it depends on the developer. I think Cyanogenmod makes use of bash.
Click to expand...

Cyanogenmod uses ash (within busybox). But it appears bash is present /system/xbin
 
How do I know if I'm patched up properly? I pasted the command that was in the Ars article into the terminal but the output doesn't read the same as the article suggests it should. Do you guys think I'm ok?
Screenshotfrom2014-09-30134732_zpsbc38bde7.png~original
 
May want to run another yum/apt update as I noticed there was another patch recently. I think they're looking for more bugs now and it sounds like some of this code is really old and may be buggy.
 
HOSED said:
^^^^ according to this link were are patched - http://www.linuxnews.pro/patch-bash-shell-shock-centos-ubuntu/
Synaptic reports version 4.3-7ubuntu1.4
Click to expand...
Thanks for the link. Makes me feel a bit better.

Chiefcrowe said:
Some Interesting background...

http://www.wired.com/2014/09/shellshocked-bash
Click to expand...
Fasinating article. Makes you wonder just how much code is still out there that has its roots in the early days of modern computing. It also makes you contemplate just how secure open source software is.
 
bbhaag said:
Fasinating article. Makes you wonder just how much code is still out there that has its roots in the early days of modern computing. It also makes you contemplate just how secure open source software is.
Click to expand...
Actually, it goes to show how little support some critical software gets. OpenSSL had three guys working on it and bash has one.
 
bbhaag said:
Fasinating article. Makes you wonder just how much code is still out there that has its roots in the early days of modern computing. It also makes you contemplate just how secure open source software is.
Click to expand...

It has already been patched in the main linux distros while Apple is taking their sweet time and letting the fanboy PR engine play it down. Arguably, it isn't as significant on OSX as almost nobody has public facing services macs. standing on the shoulders of giants...
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top