A new vulnerability has been found that potentially affects most versions of the Linux and Unix operating systems, in addition to Mac OS X. Known as the “Bash Bug” or “ShellShock,” the GNU Bash Remote Code Execution Vulnerability could allow an attacker to gain control over a targeted computer if exploited successfully. And because Bash is everywhere on Linux and UNix-like machines and interacts with all parts of the operating system, everyone anticipates that it will have lot of repercussions.
How does Shellshock work?
Shellshock exploits a flaw in how Bash parses environment variables; Bash allows functions to be stored in environment variables, but the issue is Bash will execute any code placed after the function in the environment variable value.
For example, an environment variable setting of VAR=() { ignored; }; /bin/id will execute /bin/id when the environment is imported into the bash process.
I am vulnerable?
You can check if you’re vulnerable by running the following lines in your default shell.
env X=”() { :;} ; echo vulnerable” `which bash` -c “echo Check completed”
If you see the word “vulnerable” echo’d back , then you’re at risk.
How Shellshock is Impacting the Web
The most likely route of attack is through Web servers utilizing CGI (Common Gateway Interface), the widely-used system for generating dynamic Web content. An attacker can potentially use CGI to send a malformed environment variable to a vulnerable Web server. The attacker is able to inject environment variables inside all bash process spawned by a web server under the CGI specification. This will occur directly if the CGI script is programmed in bash or indirectly by system calls inside other types of CGI scripts since the environment will propagate to the sub-shell. The vulnerability will automatically be triggered at the shell process instantiation. Furthermore if specific headers are used as attack points, the payload may not appear in the webserver logs, letting a compromise occur with virtually no trace of the intrusion.
Example:
CGI stores the HTTP headers in environment variables. Let’s say the example.com is running a CGI application written in Bash script.
We can modify the HTTP headers such that it will exploit the shellshock vulnerability in the target server and executes our code.
curl -k http://example.com/cgi-bin/test -H “User-Agent: () { :;}; echo Hacked > /tmp/Hacked.txt”
Here, the curl is sending request to the target website with the User-Agent containing the exploit code. This code will create a file “Hacked.txt” in the “/tmp” directory of the server.
What can I do to protect myself?
Major operating software vendors including RedHaT, CentOS, etc are already released a initial patch for this bug.
Debian—https://www.debian.org/security/2014/dsa-3032
Ubuntu—http://www.ubuntu.com/usn/usn-2362-1/
Red Hat—https://access.redhat.com/articles/1200223*
CentOS—http://centosnow.blogspot.com/2014/09/critical-bash-updates-for-centos-5.html
Novell/SUSE— http://support.novell.com/security/cve/CVE-2014-6271.html
If a patch is unavailable for a specific distribution of Linux or Unix, it is recommended that users switch to an alternative shell until one becomes available.
Need expert assistanace?
I can help you to patch your server against this bug and make sure you and your customers are secure. Mail me at therealfreelancer[at]gmail[dot]com.