9 ms·

If you are responsible for the security of any system, this is your immediate, drop-everything priority. The technical details of the exploit mean that new ways

If you are responsible for the security of any system, this is your immediate, drop-everything priority. The technical details of the exploit mean that new ways of exploiting it will be discovered soon. Precedent suggests that automated systematic attacks against every server on the Internet will be coming, on a time scale of hours.

matchu 12y ago
So, as a amateur sysadmin of a decently popular side project, what should I do? I've read over the post on the mailing list, and I think I understand the basic attack, but I'm having trouble understanding exactly how an attacker could run bash on my server and what I therefore need to patch (though I suspect that's intentional). Is `sudo apt-get update && sudo apt-get upgrade` sufficient on an Ubuntu server?
- ilconsigliere 12y ago
  It will be once they release a patch, yes https://security-tracker.debian.org/tracker/CVE-2014-6271 https://security-tracker.debian.org/tracker/CVE-2014-6271
  - karlkatzke 12y ago
    Already out on Ubuntu, I believe?
- clarry 12y ago
  I don't know if Ubuntu has pushed a patched version of bash, but bash is what you should update. Someone already posted a way to test whether your version is vulnerable. You might also look into changing the default shell (but beware, scripts with bashisms in them...).
  - hamiltonkibbe 12y ago
    Ubuntu pushed the update around noon 4.3-7ubuntu1.1
    - pjungwir 12y ago
      Really? I haven't been able to find any notice of that, and on 14.04 LTS if I run `sudo apt-get install --only-upgrade bash` I'm still vulnerable.
      - ForHackernews 12y ago
        http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-6271.html http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20...
      - pjungwir 12y ago
        Ah, looks like I needed to run `sudo apt-get update` first.
    - hamiltonkibbe 12y ago
      sudo apt-get update && sudo apt-get upgrade
    - gcb0 12y ago
      yeah, it was updated in debian in the morning...
- larrys 12y ago
  A good question that so far nobody has answered (as of right now).
- sauere 12y ago
  > Is `sudo apt-get update && sudo apt-get upgrade` sufficient on an Ubuntu server? Yes. Patch is out.
  - pjungwir 12y ago
    It appears that Linode changes /etc/apt/sources.list to point to their own mirror of Ubuntu repositories, and as far as I can tell those are not updated yet. So I guess the solution is to wait or edit sources.list. Just FYI if you're on their systems!
    - teach 12y ago
      Just did an update on my Linode and one of the updates was replace bash 4.1-2ubuntu3 So seems like it's there now.
      - traviscj 12y ago
        Depends on whether you have mirrors.linode.com or the ubuntu servers set up in sources.list. I had to swap mine out.
        teach 12y ago
        Well, I didn't even know about mirrors.linode.com. Mine were still the ubuntu default servers. I guess apt-get from one of Linode's mirrors saves bandwidth? Or is it just more polite?
        aaronem 12y ago
        It probably ensures that you get the Linode-customized flavors of packages where such exist, so that, for example, you don't inadvertently upgrade your kernel to a build without the ability to mount Linode disks.
        iancarroll 12y ago
- cookiecaper 12y ago
  If you're still waiting for mirrors and such to sync, you can install these packages manually on the LTS releases with the snippet here: http://hastebin.com/oraheyipug.hs http://hastebin.com/oraheyipug.hs
  - ay 12y ago
    Looks like the patched version and the pre-patched version show the same version, or am I being stupid and missing something ? ayourtch@mcmini:~/bash-patch$ ls bash_4.2-2ubuntu2.2_amd64.deb bash-builtins_4.2-2ubuntu2.2_amd64.deb t ayourtch@mcmini:~/bash-patch$ dpkg -x bash_4.2-2ubuntu2.2_amd64.deb t ayourtch@mcmini:~/bash-patch$ diff -c t/bin/bash /bin/bash Binary files t/bin/bash and /bin/bash differ ayourtch@mcmini:~/bash-patch$ t/bin/bash --version GNU bash, version 4.2.25(1)-release (x86_64-pc-linux-gnu) Copyright (C) 2011 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software; you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. ayourtch@mcmini:~/bash-patch$ /bin/bash --version GNU bash, version 4.2.25(1)-release (x86_64-pc-linux-gnu) Copyright (C) 2011 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software; you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. ayourtch@mcmini:~/bash-patch$ sha1sum t/bin/bash 9eeed02173db163b013933eff3b8c6aa3697f67f t/bin/bash ayourtch@mcmini:~/bash-patch$ sha1sum /bin/bash 3384fadf84146a4d4b6b7f529f615e9947b4ac99 /bin/bash ayourtch@mcmini:~/bash-patch$
    - cookiecaper 12y ago
      Only the build/patchset version is incremented in these packages (the -2ubuntu2.2). You can see the package version with dpkg -s bash | grep Version.
  - keithhyfn 12y ago
    Anyone have code that might work on 13.04 please?
- zobzu 12y ago
  you should update all security updates, reliably, periodically, regardless of HN posts. you're probably not directly vulnerable for this very vuln, but then again, maybe you are. with enough vulns it gets complex enough to check that its easier to just update with all the security updates..
  - detectify 12y ago
    We just updated our scanner and included this CVE. You can run Detectify to see if your setup is vulnerable. We offer a recurring service that runs continuously and alerts you if you are exposed to new emerging vulnerabilities. This removes some of the complexity of always being on top of security alerts.
    - zobzu 12y ago
      sup advertiser
- vhost- 12y ago
  If you just want to upgrade bash, and prevent services like nginx, fpm, and apache from being restarted in production, you can run `sudo apt-get update && sudo apt-get install --only-upgrade bash` Related to that, does anyone else know if upgrading bash will require a restart of other services kind of like upgrading openssl requires restarting things?
  - auxiliation 12y ago
    > Related to that, does anyone else know if upgrading bash will require a restart of other services kind of like upgrading openssl requires restarting things? I don't think it will, for a couple of reasons. OpenSSL is integrated into other services as a library, while bash would be called as an external application. I also noticed that once I upgraded bash, the proof of concept stopped working in a terminal I opened prior to the upgrade.
    - fragmede 12y ago
      > I also noticed that once I upgraded bash, the proof of concept stopped working in a terminal I opened prior to the upgrade. [citation needed] because that doesn't sound possible.
      - lutusp 12y ago
        Not if the issued commands spawned a new copy of Bash.
      - deleted 12y ago
        [deleted]
  - euid 12y ago
    Upgrades should not require any restarts, and no restarts are required for you to stop being vulnerable - as this only affects newly created bash sessions, not already running ones.
    - stefantalpalaru 12y ago
larrys 12y ago
"If you are responsible for the security of any system, this is your immediate, drop-everything priority." Why don't you explain in plain english exactly why you feel this is the case? "Drop-everything" in other words (or even close to that). Give some scenarios. After all anyone who knows a great deal doesn't need that advice the people who need that advice are ones that don't know enough to know what the impact of this is. [1] Perhaps you could clarify with some examples of why (see child comment "So, as a amateur sysadmin of a decently popular side project") you think this applies to anyone who is "responsible for the security of any system"? [1] Me for one because I'm not seeing the "Drop everything" priority for any of the systems that I have control over given the way they are configured. That said I'd like to hear more of course.
- tptacek 12y ago
  Any library anywhere in any application you run that calls out to bash that is called by any other library in that application, so long as that application is somehow hooked up to a web server, is potentially an unauthenticated GET request away from code execution; the exploit for this is potentially so simple that attackers can craft a single request, spider the Internet, and collect shells from applications you run that you forgot you even ran, at which point they'll own your whole data center. Helpful?
  - larrys 12y ago
    So for example if you don't run web servers that are front facing on the internet (and you trust your (for example) intranet) then does this become an "asap" rather than a "drop everything"? "is potentially an unauthenticated GET request" Are you saying that if you don't have a web server that allows "get" requests (only posts) then this exploit is not an issue at all?
    - deleted 12y ago
      [deleted]
    - danielweber 12y ago
      Read "unauthenticated GET request" as "people who can do the very very simplest thing to your webserver will find this."
maximumoverload 12y ago
It doesn't have a nice catchy name and a logo, though
- dsr_ 12y ago
  Fine. Now it's called BashSmash. Are you happy? Go make a logo.
  - fragmede 12y ago
    Someone already made on a few hours ago... https://i.imgur.com/ilJbM74.png https://i.imgur.com/ilJbM74.png
    - maximumoverload 12y ago
      That's really ugly and not a real logo.
  - maximumoverload 12y ago
    People are now calling it "Shellshock". That's nice. I like this song. https://www.youtube.com/watch?v=2pWZRJd4z8o https://www.youtube.com/watch?v=2pWZRJd4z8o
    - sireat 12y ago
      That's funny, showing my age, but "Shellshock" immediately brings up a completely different song in my mind: https://www.youtube.com/watch?v=JUhZ30D7tYU https://www.youtube.com/watch?v=JUhZ30D7tYU

matchu 12y ago

So, as a amateur sysadmin of a decently popular side project, what should I do? I've read over the post on the mailing list, and I think I understand the basic attack, but I'm having trouble understanding exactly how an attacker could run bash on my server and what I therefore need to patch (though I suspect that's intentional). Is `sudo apt-get update && sudo apt-get upgrade` sufficient on an Ubuntu server?

ilconsigliere 12y ago
It will be once they release a patch, yes https://security-tracker.debian.org/tracker/CVE-2014-6271 https://security-tracker.debian.org/tracker/CVE-2014-6271
- karlkatzke 12y ago
  Already out on Ubuntu, I believe?
clarry 12y ago
I don't know if Ubuntu has pushed a patched version of bash, but bash is what you should update. Someone already posted a way to test whether your version is vulnerable. You might also look into changing the default shell (but beware, scripts with bashisms in them...).
- hamiltonkibbe 12y ago
  Ubuntu pushed the update around noon 4.3-7ubuntu1.1
  - pjungwir 12y ago
    Really? I haven't been able to find any notice of that, and on 14.04 LTS if I run `sudo apt-get install --only-upgrade bash` I'm still vulnerable.
    - ForHackernews 12y ago
      http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-6271.html http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20...
    - pjungwir 12y ago
      Ah, looks like I needed to run `sudo apt-get update` first.
  - hamiltonkibbe 12y ago
    sudo apt-get update && sudo apt-get upgrade
  - gcb0 12y ago
    yeah, it was updated in debian in the morning...
larrys 12y ago
A good question that so far nobody has answered (as of right now).
sauere 12y ago
> Is `sudo apt-get update && sudo apt-get upgrade` sufficient on an Ubuntu server? Yes. Patch is out.
- pjungwir 12y ago
  It appears that Linode changes /etc/apt/sources.list to point to their own mirror of Ubuntu repositories, and as far as I can tell those are not updated yet. So I guess the solution is to wait or edit sources.list. Just FYI if you're on their systems!
  - teach 12y ago
    Just did an update on my Linode and one of the updates was replace bash 4.1-2ubuntu3 So seems like it's there now.
    - traviscj 12y ago
      Depends on whether you have mirrors.linode.com or the ubuntu servers set up in sources.list. I had to swap mine out.
      - teach 12y ago
        Well, I didn't even know about mirrors.linode.com. Mine were still the ubuntu default servers. I guess apt-get from one of Linode's mirrors saves bandwidth? Or is it just more polite?
        aaronem 12y ago
        It probably ensures that you get the Linode-customized flavors of packages where such exist, so that, for example, you don't inadvertently upgrade your kernel to a build without the ability to mount Linode disks.
        iancarroll 12y ago
cookiecaper 12y ago
If you're still waiting for mirrors and such to sync, you can install these packages manually on the LTS releases with the snippet here: http://hastebin.com/oraheyipug.hs http://hastebin.com/oraheyipug.hs
- ay 12y ago
  Looks like the patched version and the pre-patched version show the same version, or am I being stupid and missing something ? ayourtch@mcmini:~/bash-patch$ ls bash_4.2-2ubuntu2.2_amd64.deb bash-builtins_4.2-2ubuntu2.2_amd64.deb t ayourtch@mcmini:~/bash-patch$ dpkg -x bash_4.2-2ubuntu2.2_amd64.deb t ayourtch@mcmini:~/bash-patch$ diff -c t/bin/bash /bin/bash Binary files t/bin/bash and /bin/bash differ ayourtch@mcmini:~/bash-patch$ t/bin/bash --version GNU bash, version 4.2.25(1)-release (x86_64-pc-linux-gnu) Copyright (C) 2011 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software; you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. ayourtch@mcmini:~/bash-patch$ /bin/bash --version GNU bash, version 4.2.25(1)-release (x86_64-pc-linux-gnu) Copyright (C) 2011 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software; you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. ayourtch@mcmini:~/bash-patch$ sha1sum t/bin/bash 9eeed02173db163b013933eff3b8c6aa3697f67f t/bin/bash ayourtch@mcmini:~/bash-patch$ sha1sum /bin/bash 3384fadf84146a4d4b6b7f529f615e9947b4ac99 /bin/bash ayourtch@mcmini:~/bash-patch$
  - cookiecaper 12y ago
    Only the build/patchset version is incremented in these packages (the -2ubuntu2.2). You can see the package version with dpkg -s bash | grep Version.
- keithhyfn 12y ago
  Anyone have code that might work on 13.04 please?
zobzu 12y ago
you should update all security updates, reliably, periodically, regardless of HN posts. you're probably not directly vulnerable for this very vuln, but then again, maybe you are. with enough vulns it gets complex enough to check that its easier to just update with all the security updates..
- detectify 12y ago
  We just updated our scanner and included this CVE. You can run Detectify to see if your setup is vulnerable. We offer a recurring service that runs continuously and alerts you if you are exposed to new emerging vulnerabilities. This removes some of the complexity of always being on top of security alerts.
  - zobzu 12y ago
    sup advertiser
vhost- 12y ago
If you just want to upgrade bash, and prevent services like nginx, fpm, and apache from being restarted in production, you can run `sudo apt-get update && sudo apt-get install --only-upgrade bash` Related to that, does anyone else know if upgrading bash will require a restart of other services kind of like upgrading openssl requires restarting things?
- auxiliation 12y ago
  > Related to that, does anyone else know if upgrading bash will require a restart of other services kind of like upgrading openssl requires restarting things? I don't think it will, for a couple of reasons. OpenSSL is integrated into other services as a library, while bash would be called as an external application. I also noticed that once I upgraded bash, the proof of concept stopped working in a terminal I opened prior to the upgrade.
  - fragmede 12y ago
    > I also noticed that once I upgraded bash, the proof of concept stopped working in a terminal I opened prior to the upgrade. [citation needed] because that doesn't sound possible.
    - lutusp 12y ago
      Not if the issued commands spawned a new copy of Bash.
    - deleted 12y ago
      [deleted]
- euid 12y ago
  Upgrades should not require any restarts, and no restarts are required for you to stop being vulnerable - as this only affects newly created bash sessions, not already running ones.
  - stefantalpalaru 12y ago

larrys 12y ago

"If you are responsible for the security of any system, this is your immediate, drop-everything priority." Why don't you explain in plain english exactly why you feel this is the case? "Drop-everything" in other words (or even close to that). Give some scenarios. After all anyone who knows a great deal doesn't need that advice the people who need that advice are ones that don't know enough to know what the impact of this is. [1] Perhaps you could clarify with some examples of why (see child comment "So, as a amateur sysadmin of a decently popular side project") you think this applies to anyone who is "responsible for the security of any system"? [1] Me for one because I'm not seeing the "Drop everything" priority for any of the systems that I have control over given the way they are configured. That said I'd like to hear more of course.

tptacek 12y ago
Any library anywhere in any application you run that calls out to bash that is called by any other library in that application, so long as that application is somehow hooked up to a web server, is potentially an unauthenticated GET request away from code execution; the exploit for this is potentially so simple that attackers can craft a single request, spider the Internet, and collect shells from applications you run that you forgot you even ran, at which point they'll own your whole data center. Helpful?
- larrys 12y ago
  So for example if you don't run web servers that are front facing on the internet (and you trust your (for example) intranet) then does this become an "asap" rather than a "drop everything"? "is potentially an unauthenticated GET request" Are you saying that if you don't have a web server that allows "get" requests (only posts) then this exploit is not an issue at all?
  - deleted 12y ago
    [deleted]
  - danielweber 12y ago
    Read "unauthenticated GET request" as "people who can do the very very simplest thing to your webserver will find this."

maximumoverload 12y ago

It doesn't have a nice catchy name and a logo, though

dsr_ 12y ago
Fine. Now it's called BashSmash. Are you happy? Go make a logo.
- fragmede 12y ago
  Someone already made on a few hours ago... https://i.imgur.com/ilJbM74.png https://i.imgur.com/ilJbM74.png
  - maximumoverload 12y ago
    That's really ugly and not a real logo.
- maximumoverload 12y ago
  People are now calling it "Shellshock". That's nice. I like this song. https://www.youtube.com/watch?v=2pWZRJd4z8o https://www.youtube.com/watch?v=2pWZRJd4z8o
  - sireat 12y ago
    That's funny, showing my age, but "Shellshock" immediately brings up a completely different song in my mind: https://www.youtube.com/watch?v=JUhZ30D7tYU https://www.youtube.com/watch?v=JUhZ30D7tYU