Remote Exploit Vulnerability Found In Bash

kdryer39 sends this news from CSO: A remotely exploitable vulnerability has been discovered by Stephane Chazelas in bash on Linux, and it is unpleasant. The vulnerability has the CVE identifier CVE-2014-6271. This affects Debian as well as other Linux distributions. The major attack vectors that have been identified in this case are HTTP requests and CGI scripts. Another attack surface is OpenSSH through the use of AcceptEnv variables. Also through TERM and SSH_ORIGINAL_COMMAND. An environmental variable with an arbitrary name can carry a nefarious function which can enable network exploitation.

Comments

Full Disclosure can be found on oss-security...

[Jizzbug]

https://marc.info/?l=oss-security&m=141157106132018&w=2

Already fixed in Debian...

[msauve]

Linky

Test string here:

[B5_geek]

This is the test to see if you are vulnerable:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

Re:Test string here:

[B5_geek]

SSH into your host.
from the bash prompt just paste the above string.

i.e.
user@host $env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

--------------------
If you see:
vulnerable
this is a test
Then you are vulnerable and need to update your system.

If all you see is:
this is a test

Then you are ok.

Re:Test string here:

[OzPeter]

I just tried it on 2 different version s of OSX: 10.9.4 and 10.7.5 and confirm that they print out the "vulnerable" message

Not arbitrary variables - QUERY_STRING

[raymorris]

> Oh I had the same thought....I mean, by the time an "attacker" is modifying arbitrary environment variables in your process, well...you are already pretty compromised. If you wrote your CGI, then you are the one that compromised yourself.

The contents of the CGI script don't matter. The exploit occurs before the script runs. It happens as bash is setting up the environment in which the script will be run.

Suppose you have pwd.cgi, which prints the name of the current directory:

#!/bin/sh
echo -e "Content-type: text/plain\n\n"
pwd

Notice the script uses no input at all. It is potentially vulnerable. Here's why. Suppose you did want to validate your input. You'd look at the contents of $QUERY_STRING, right? You can find what the user entered in the QUERY_STRING environment variable because bash puts it there. That's the step where the problem lies - bash can EXECUTE the contents of the query string while setting the environment variable. This occurs before the user's script even begins to run.