CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by owenfi on Thursday September 25, 2014 @03:14AM (#8366014)

The exploit worked against my cgi perl scripts as well!

I had cgi-bin/update.pl running on OS X and I exploited it as mentioned here: https://twitter.com/hernano/status/514866681530023936

My perl scripts call $out = `git pull`, log to a file, and print a response; I was quite surprised the exploit worked against them. Promptly disabled, upgraded bash, and re-enabled, now disabling all cgi for a bit longer.

What are the common vectors beyond CGI-space for the average server? How do we find and test them?

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by odc on Thursday September 25, 2014 @04:00AM (#8366118)

Yes, this exploit can be used on any script or program that uses system(), whatever language you use.

Using bash as the default /bin/sh is the real bug here.

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by dllthomas on Thursday September 25, 2014 @10:34AM (#8367361)

"Yes, this exploit can be used on any script or program that uses system(), whatever language you use."

Unless that script or program sanitizes the environment before calling system(). In practice that might not presently be any scripts or programs, but it principle it's a tiny bit weaker than you say.

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by eCa on Thursday September 25, 2014 @03:24AM (#8366038)

Not sure if it helps against this vulnerability, but using Git::Wrapper [1] makes for much nicer code than backticks.

[1] https://metacpan.org/pod/Git::Wrapper

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by owenfi on Thursday September 25, 2014 @03:40AM (#8366073)

Awesome, thanks. Seems like it would've.

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by ordinary on Thursday September 25, 2014 @03:31AM (#8366052)

Perl backticks and system() delegate commands to the system shell, normally sh. On many systems, sh is simply bash in compatibility mode. That's how the attacker gets at the vulnerability.

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by justincormack on Thursday September 25, 2014 @08:00AM (#8366683)

Nice that "compatibility mode" does not bother to disable this technically non compatible behaviour...

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by owenfi on Thursday September 25, 2014 @03:38AM (#8366070)

Thanks. Suspected as much, but still a bit petrified that the shell var/func passed through perl to the backtick-shell.

[ Parent | on HN ]

Re:CVE-2014-7169: Bash Fix Incomplete, Still Exploitable by mutation on Thursday September 25, 2014 @05:24AM (#8366319)

system() delegates to shell only in the case of one argument given to system().

[ Parent | on HN ]