3 ms·

So for example if you don't run web servers that are front facing on the internet (and you trust your (for example) intranet) then does this become an "asap" ra

by larrys 12y ago

So for example if you don't run web servers that are front facing on the internet (and you trust your (for example) intranet) then does this become an "asap" rather than a "drop everything"? "is potentially an unauthenticated GET request" Are you saying that if you don't have a web server that allows "get" requests (only posts) then this exploit is not an issue at all?

deleted 12y ago
[deleted]
danielweber 12y ago
Read "unauthenticated GET request" as "people who can do the very very simplest thing to your webserver will find this."
droopybuns 12y ago
I'm sure that the people at Home Depot knew for certain that their network was secure right up until the moment they discovered they were hacked. You can learn by experience, or you can try to leach the wisdom of others.
rmc 12y ago
Are you saying that if you don't have a web server that allows "get" requests (only posts) then this exploit is not an issue at all? Usually no. This exploit should be vulnerable to any HTTP method. "unathenticed GETs" are the lowest security level of HTTP calls, so if they can be used as an attack vector, you should pay attention.
cuillevel3 12y ago
I like the DHCP attack vector which was mentioned in the RedHat posting. DHCP clients invoke shell scripts.
- daveloyall 12y ago
  Just curious, how long can a wireless SSID be? I ask because I've seen SSIDs with meaningful characters ()<>;? cause trouble with some network managers. I presumed at the time that this was due to the SSID string being passed as an argument to some script. I've encountered this on my old Android phone and my old Debian laptop. I encountered it often because a friend of mine used to have an emoticon in the SSID for his home router. (Really annoying! I couldn't connect to anything when his router was in range.) Note: it could very well have been a different problem. I didn't investigate.
stouset 12y ago
No, that is not what tptacek is saying. Unauthenticated GET requests were just an example of something that can invoke this behavior. If you have any network-enabled service that's capable of spawning a shell, you can have attack vectors open. Possible vectors include things like DHCP clients, SSH, web servers, etc. Lots of things open shells for reasons you wouldn't intuitively expect. It's very likely that there are many creative vectors for exploitation that will be discovered in the coming hours.
- deleted 12y ago
  [deleted]
jerf 12y ago
The attack surface of this bug may very well be the largest attack surface of any bug in history. Update bash. Just update bash. Everywhere. On everything you have it on. Don't think about whether, just think about how. (Note I'm not claiming this is the "worst bug ever"... there's stiff competition for that claim. But most of the rest of the "worst bug ever"s I can think of are some point that failed, some particular thing you could do for full root access or something. I can't think of anything else with this sheer staggering surface area.)

by larrys 12y ago

deleted 12y ago

[deleted]

danielweber 12y ago

Read "unauthenticated GET request" as "people who can do the very very simplest thing to your webserver will find this."

droopybuns 12y ago

I'm sure that the people at Home Depot knew for certain that their network was secure right up until the moment they discovered they were hacked. You can learn by experience, or you can try to leach the wisdom of others.

rmc 12y ago

Are you saying that if you don't have a web server that allows "get" requests (only posts) then this exploit is not an issue at all? Usually no. This exploit should be vulnerable to any HTTP method. "unathenticed GETs" are the lowest security level of HTTP calls, so if they can be used as an attack vector, you should pay attention.

cuillevel3 12y ago

I like the DHCP attack vector which was mentioned in the RedHat posting. DHCP clients invoke shell scripts.

daveloyall 12y ago
Just curious, how long can a wireless SSID be? I ask because I've seen SSIDs with meaningful characters ()<>;? cause trouble with some network managers. I presumed at the time that this was due to the SSID string being passed as an argument to some script. I've encountered this on my old Android phone and my old Debian laptop. I encountered it often because a friend of mine used to have an emoticon in the SSID for his home router. (Really annoying! I couldn't connect to anything when his router was in range.) Note: it could very well have been a different problem. I didn't investigate.

stouset 12y ago

No, that is not what tptacek is saying. Unauthenticated GET requests were just an example of something that can invoke this behavior. If you have any network-enabled service that's capable of spawning a shell, you can have attack vectors open. Possible vectors include things like DHCP clients, SSH, web servers, etc. Lots of things open shells for reasons you wouldn't intuitively expect. It's very likely that there are many creative vectors for exploitation that will be discovered in the coming hours.

deleted 12y ago
[deleted]

jerf 12y ago

The attack surface of this bug may very well be the largest attack surface of any bug in history. Update bash. Just update bash. Everywhere. On everything you have it on. Don't think about whether, just think about how. (Note I'm not claiming this is the "worst bug ever"... there's stiff competition for that claim. But most of the rest of the "worst bug ever"s I can think of are some point that failed, some particular thing you could do for full root access or something. I can't think of anything else with this sheer staggering surface area.)