[Discuss] Shellshock

[Darren Duncan]

On 2014-09-25, 8:57 PM, Deryk Barker wrote:>> Furthermore,
> env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"
>
> shows that the system is not vulnerable. I guess I must be up to date.

Something not mentioned on this list is that all bash systems are still vulnerable.

A patch released yesterday did stop the above example from being exploited, but 
other examples such as this are still vulnerabilities:

   env a='() { (a)=>\' sh -c "echo date"; cat echo

Run that on your fully patched box, it would give syntax error messages but it 
would also create a file named 'echo' in the CWD with the current date inside.

So officially bash is still vulnerable, and any patches to date only fixed a 
portion.

As to exploitation, it seems a lot of the problem occurs when you have some 
other program, eg some CGI script, which turns around and invokes bash as part 
of its internal processing.  The bad guys are scanning for other programs, and 
there would be many, that use bash internally, and that's the problem, that this 
is so common.  A lot of it in older stuff that would never be patched. 
Including home routers and such.

-- Darren Duncan