5 ms·

Except that bash is not installed by default... if bash is not installed how does BSD suddenly become vulnerable?

• nitrogen 12y ago
  It would have been installed as a dependency of whatever used it in some obscure way.
  • nitrogen 12y ago
    Okay, since someone actually downvoted both of my comments, I'll point out that libgpgme is a common encryption library that calls /usr/bin/gpg. Fortunately it uses execv(), but that leaves the environment unchanged so if anything further down the chain uses Bash it's still vulnerable. I'll also provide a list of files from /usr/bin that are actually implemented using Bash (from a Linux Mint system). Anything using these with user-controlled environment variable values is vulnerable: $ grep -nR '#!.*bash' * | grep :1: apg:1:#!/bin/bash aptitude-create-state-bundle:1:#!/bin/bash aptitude-run-state-bundle:1:#!/bin/bash banshee:1:#!/usr/bin/env bash cautious-launcher:1:#!/bin/bash checkinstall:1:#!/bin/bash cinnamon2d:1:#!/bin/bash dns-fix:1:#!/bin/bash editdiff:1:#!/bin/bash fakenect:1:#!/bin/bash fakeroot:1:#!/bin/bash fakeroot-sysv:1:#!/bin/bash fakeroot-tcp:1:#!/bin/bash gnome-www-browser:1:#!/bin/bash google-chrome:1:#!/bin/bash google-chrome-stable:1:#!/bin/bash gufw-pkexec:1:#!/bin/bash im-config:1:#!/bin/bash -e init-checkconf:1:#!/bin/bash installwatch:1:#!/bin/bash inxi:1:#!/bin/bash itweb-settings:1:#!/bin/bash javaws:1:#!/bin/bash lcf:1:#!/bin/bash ldd:1:#! /bin/bash libtool:1:#! /bin/bash lua2dox_filter:1:#!/bin/bash lzcmp:1:#!/bin/bash lzdiff:1:#!/bin/bash lzegrep:1:#!/bin/bash lzfgrep:1:#!/bin/bash lzgrep:1:#!/bin/bash lzless:1:#!/bin/bash lzmore:1:#!/bin/bash mate-help:1:#!/bin/bash mintBackup:1:#!/bin/bash mint-fortune:1:#!/bin/bash mintupload:1:#!/bin/bash mintupload-manager:1:#!/bin/bash muinshee:1:#!/usr/bin/env bash mysqld_safe:1:#!/bin/bash p7zip:1:#!/bin/bash pipelight-plugin:1:#!/usr/bin/env bash pnmindex:1:#!/bin/bash policyeditor:1:#!/bin/bash ppmquantall:1:#!/bin/bash rarian-sk-config:1:#!/bin/bash rarian-sk-extract:1:#!/bin/bash rarian-sk-rebuild:1:#!/bin/bash rarian-sk-update:1:#!/bin/bash scrollkeeper-config:1:#!/bin/bash scrollkeeper-extract:1:#!/bin/bash scrollkeeper-rebuilddb:1:#!/bin/bash scrollkeeper-update:1:#!/bin/bash sotruss:1:#! /bin/bash steam:1:#!/usr/bin/env bash su-to-root:1:#!/bin/bash tomboy:1:#!/usr/bin/env bash tzselect:1:#!/bin/bash ucf:1:#!/bin/bash ucfr:1:#! /bin/bash usb-devices:1:#!/bin/bash X11/scrollkeeper-config:1:#!/bin/bash X11/fakenect:1:#!/bin/bash X11/lzgrep:1:#!/bin/bash X11/cautious-launcher:1:#!/bin/bash X11/xzdiff:1:#!/bin/bash X11/aptitude-create-state-bundle:1:#!/bin/bash X11/mint-fortune:1:#!/bin/bash X11/mate-help:1:#!/bin/bash X11/scrollkeeper-extract:1:#!/bin/bash X11/fakeroot:1:#!/bin/bash X11/editdiff:1:#!/bin/bash X11/lzdiff:1:#!/bin/bash X11/apg:1:#!/bin/bash X11/mintupload-manager:1:#!/bin/bash X11/gnome-www-browser:1:#!/bin/bash X11/ucfr:1:#! /bin/bash X11/lzcmp:1:#!/bin/bash X11/libtool:1:#! /bin/bash X11/im-config:1:#!/bin/bash -e X11/xzmore:1:#!/bin/bash X11/mintupload:1:#!/bin/bash X11/xzegrep:1:#!/bin/bash X11/javaws:1:#!/bin/bash X11/xchat-systray:1:#!/bin/bash X11/itweb-settings:1:#!/bin/bash X11/dns-fix:1:#!/bin/bash X11/su-to-root:1:#!/bin/bash X11/checkinstall:1:#!/bin/bash X11/usb-devices:1:#!/bin/bash X11/rarian-sk-extract:1:#!/bin/bash X11/tzselect:1:#!/bin/bash X11/google-chrome-stable:1:#!/bin/bash X11/xzcmp:1:#!/bin/bash X11/xzgrep:1:#!/bin/bash X11/pipelight-plugin:1:#!/usr/bin/env bash X11/lcf:1:#!/bin/bash X11/scrollkeeper-rebuilddb:1:#!/bin/bash X11/banshee:1:#!/usr/bin/env bash X11/cinnamon2d:1:#!/bin/bash X11/xzfgrep:1:#!/bin/bash X11/muinshee:1:#!/usr/bin/env bash X11/lzfgrep:1:#!/bin/bash X11/mintBackup:1:#!/bin/bash X11/tomboy:1:#!/usr/bin/env bash X11/fakeroot-sysv:1:#!/bin/bash X11/aptitude-run-state-bundle:1:#!/bin/bash X11/gufw-pkexec:1:#!/bin/bash X11/init-checkconf:1:#!/bin/bash X11/x-www-browser:1:#!/bin/bash X11/lzegrep:1:#!/bin/bash X11/rarian-sk-update:1:#!/bin/bash X11/sotruss:1:#! /bin/bash X11/ldd:1:#! /bin/bash X11/ppmquantall:1:#!/bin/bash X11/rarian-sk-rebuild:1:#!/bin/bash X11/xzless:1:#!/bin/bash X11/rarian-sk-config:1:#!/bin/bash X11/p7zip:1:#!/bin/bash X11/google-chrome:1:#!/bin/bash X11/lzmore:1:#!/bin/bash X11/fakeroot-tcp:1:#!/bin/bash X11/mysqld_safe:1:#!/bin/bash X11/ucf:1:#!/bin/bash X11/policyeditor:1:#!/bin/bash X11/lzless:1:#!/bin/bash X11/lua2dox_filter:1:#!/bin/bash X11/installwatch:1:#!/bin/bash X11/inxi:1:#!/bin/bash X11/scrollkeeper-update:1:#!/bin/bash X11/steam:1:#!/usr/bin/env bash X11/pnmindex:1:#!/bin/bash xchat-systray:1:#!/bin/bash x-www-browser:1:#!/bin/bash xzcmp:1:#!/bin/bash xzdiff:1:#!/bin/bash xzegrep:1:#!/bin/bash xzfgrep:1:#!/bin/bash xzgrep:1:#!/bin/bash xzless:1:#!/bin/bash xzmore:1:#!/bin/bash
    • jldugger 12y ago
      That's a desktop. Come back when you've audited the popcon top 100.
      • nitrogen 12y ago
        That's a goalpost. Come back when it's not moving.
        • deleted 12y ago
          [deleted]
    • clarry 12y ago
      And before you believe that your Linux box is any indication of how common a dependency bash is... I just grepped all the Makefiles in my ports tree for 'shells/bash', and came up with 48 matches. This includes ports that depend on bash at build time, at test time, and at runtime. So for people who just use packages, the number of things that are going to pull in bash (as a runtime dep) is lower than that. We have many of the same programs you have, but they do not use bash. For example, all your executables that start with xz or lz. I have them, most of them anyway, but they use /bin/sh, not /bin/bash. I use BSD on the desktop, and out of the three hundred packages I have installed, none have pulled bash in as a dep. I don't have bash, I haven't had it for years.
      • X-Istence 12y ago
        There is a couple more ports out there that require it for run, but the numbers are quite low considering the amount of software that is available in the ports tree: http://www.freshports.org/shells/bash http://www.freshports.org/shells/bash
        • clarry 12y ago
          My numbers are from the OpenBSD ports tree.
• jameshart 12y ago
  This is as helpful as a windows admin saying 'this whole thing seems to be blown out of proportion, none of my servers are vulnerable'.