ShellShock Bash Bug

Reported attacks using 'Shellshock' aka Bash bug & Patch News

The bug affects both Linux and Mac OS X

"This is not a bug to fool around with. It has the potential to wreak havoc with your systems. Worse still, a smart attacker could just leave malware mines behind to steal data after the fact"

Linux users got a nasty surprise on 24th September, as a security team at Red Hat uncovered a subtle but dangerous bug in the Bash shell, one of the most versatile and widely used utilities in Linux. It's being called the Bash bug, or Shellshock.

Good News: Patch Releases

The good news yesterday that major Linux distributions shipped patches for the bug.
Red Hat said that they are posting new patches today for affected versions:

Testing for the Shellshock vulnerability

Method 1: Via Command Line

To determine if your Linux or Unix system is vulnerable, from a command line, type:

env x=’() { :;}; echo vulnerable’ bash -c “echo this is a test”

If the system is vulnerable, the output will be:

vulnerable

this is a test

An unaffected (or patched) system will output:

bash: warning: x: ignoring function definition attempt

bash: error importing function definition for `x’

this is a test

Method 2: Via an online tool

An online tool to test the vulnerability is available at:

Background info:

When accessed properly, the bug allows for an attacker's code to be executed as soon as the shell is invoked, leaving the door open for a wide variety of attacks. Worse yet, it appears the bug has been present in enterprise Linux software for a long time, so patching every instance may be easier said than done.

The root of the problem is that Bash is frequently used as the system shell. Thus, if an application calls a Bash shell command via web HTTP or a Common-Gateway Interface (CGI) in a way that allows a user to insert data, the web server could be hacked.

The most dangerous circumstance is if your applications call scripts with super-user — aka root — permissions. If that's the case, your attacker could get away with murder on your server.

On Wednesday, AusCERT and MalwareMustDie reported that Bash Bug is being exploited in the wild.

According to data produced in a recent survey published by Netcraft, the number and types of Web servers being used worldwide is more than 1 billion servers, and that more than half of those are Apache servers, which run Linux and thus contain Bash by default.

The potential targets include home routers, medical equipment, SCADA/ICS devices and much more, for this reason the Bash Bug is considered by security experts more dangerous than Heartbleed flaw which affected only versions of OpenSSL released over a two-year period.

So what can you do?
(Steven J. Vaughan-Nichols) First you should sanitize the web applications' inputs. If you've already done this against such common attacks as cross-site scripting (XSS) or SQL injection, you'll already have some protection.

Next, disable any CGI scripts that call on the shell. (I'd also like to know why you're still using a 21-year old way of allowing users to interact with your web services. You might want to use this opportunity to replace your CGI scripts once and for all.)
After that, switch "away from using Bash to another shell." But keep in mind that the alternative shell will not use exactly the same syntax and it may not have all the same features. This means if you try this fix, some of your web applications are likely to start acting up.

Of course, the real fix will be to replace the broken Bash with a new, secure one. As of the morning of September 24, Bash's developers have patched all current versions of Bash, from 3.0 to 4.3. At this time, only Debian and Red Hat appear to have packaged patches ready to go.

OpenSSH is also vulnerable via the use of AcceptEnv variables, TERM, and SSH_ORIGINAL_COMMAND. However, since to access those you already need to be in an authenticated session, you're relatively safe. That said, you'd still be safer if you blocked non-administrative users from using OpenSSH until the underlying Bash problem is patched.

SECURENET SOLUTIONS

Red Hat Engineer Resources

Network & Server Intrusion Prevention Solution

Network Access Control Gateway Solution

P: +44(0)7714 209927

S: +44(0)1273 329753

info@securenetconsulting.co.uk