bodyfour

24 ms·

211.
by bodyfour 12y ago
I generally agree with this, but I do have a few nitpicks. > Comparing this to Heartbleed is pretty absurd They're such different bugs that they're hard to compare. Heartbleed definitely affected more high-value targets, howev
212.
by bodyfour 12y ago
The attack isn't against terminal shells. The biggest risk is against things that use the shell implicitly like system()/popen()/etc and they all use /bin/sh It's certainly possible to be at risk if, for insta
213.
by bodyfour 12y ago
That's incorrect; it does not appear to have the "export function" feature that this bug relies on.
214.
by bodyfour 12y ago
Note that you'll typically want to supply the URL to a CGI script on the site, not just www.example.com. Don't think you're unaffected just because the top-level page of your site doesn't appear vulnerable.
215.
by bodyfour 12y ago
That will only find either clumsy exploit attempts or whitehat scans that are not trying to hide themselves. CGI sends most headers through to the script as environment variables (i.e. a Foobar: header will turn into $HTTP_FOOBAR) so at att
216.
by bodyfour 12y ago
It won't be as simple as scanning all IP4 space because for most vulnerable hosts you still will need to know a URL of a cgi program that can cause bash to be executed (either because they're written in shell or, more likely, that
217.
by bodyfour 12y ago
> plain C that uses system() call? Lots of code uses system()/popen() etc. If no user-controlled input is passed in as an argument, most people would have not considered that a potential vulnerability. More software than you think
218.
by bodyfour 12y ago
... and also a reflection of how much security attention this one obscure feature has been receiving in the last 24 hours. This is very similar to the pattern we saw with heartbleed: a terrible bug with a lot of publicity followed by a seri
219.
by bodyfour 12y ago
CGI will typically pass most any header along as a HTTP_headername environment variable (HTTP_HOST is just one example) I'd expect most malicious exploiters to use a non-standard header, since User-Agent's value is often logged.
220.
by bodyfour 12y ago
Just apply the security updates as they arrive from Apple. The highest-risk activities like running a webserver hosting CGI scripts isn't likely to apply to you. I can't say for certain nobody will find a clever client-side atta
221.
by bodyfour 12y ago
Most likely they're packaging some already published local root exploit and combining it with ShellShock.
222.
by bodyfour 12y ago
If you see that "ignoring function definition attempt" message you definitely have the first patch applied (but not necessarily a fix for the second problem) That diagnositc was added by the patch itself. See http://f
223.
by bodyfour 12y ago
> On OSX and Solaris, I've chmod'ed 0000 /bin/bash with no apparent ill effect so far. In the case of OSX, /bin/sh is also bash. For some reason they are separate binaries (at least on my laptop running 10.
224.
by bodyfour 12y ago
The only attack vectors I've seen so far are: * webservers that are configured to run things via the ancient CGI interface. There are lots of these on the internet (so that's bad) but most OSes aren't going to be vulnerable
225.
by bodyfour 12y ago
It's so you can export a function into child shells: http://stackoverflow.com/questions/1885871/exporting-a-funct... Hardly worth the security cost in retrospect, but some bash scripts will surely break if it
226.
by bodyfour 12y ago
OS/X does use bash as /bin/sh unfortunately so it is fairly vulnerable. Probably most people won't be affected though since there aren't many good attack vectors against a client machine, and not many people are st
227.
by bodyfour 12y ago
Answering my own question, since I got curious enough to look a the source: if (privmode == 0 && read_but_dont_execute == 0 && STREQN ("() {", string, 4)) So it has to start with that four character sequen
228.
by bodyfour 12y ago
That was one of my first thoughts as well. There is way too much code that's being exposed here. This will be a gift that keeps on giving. For people who want to do environment sanitation, do we know what values can trigger this &#x2
229.
by bodyfour 12y ago
The first UNIX machine that I used was a 286. There were several companies that offered UNIX or UNIX-like environments on AT hardware. In my case I began with Microport UNIX, but I did get my share of Xenix later on. In our case we had se
230.
by bodyfour 12y ago
> won't grant Do we know that? In this case it seems that they just didn't bother to apply. Unfortunately, that seems to be the normal way these ridesharing companies operate: ignore the law knowing that when they're cal
231.
by bodyfour 12y ago
...especially for code that's macro heavy. It's easy to have code where a macro is including a memset to protect some invariant. The compiler can see the bigger picture and realizes that the memset target isn't actually rea
232.
by bodyfour 12y ago
It is interesting to ponder how much the world would have been different if the PRC had just gone all the way to Pinyin when they decided to simplify the writing system. Also interesting: the linguist who developed Pinyin is apparently stil
233.
by bodyfour 12y ago
The real problem with chdir is when that code ends up refactored into a library and ends up used in a multithreaded program. Then you've got an ugly bug.
234.
by bodyfour 12y ago
As @jjnoakes points out, you'll get malloc()==NULL if your ulimits are set. For a long-running program you definitely want to have a ulimit that will kick in before the OOM killer does. Even in the absence of the OOM killer (i.e. the
235.
by bodyfour 12y ago
Depends on if you need to gracefully handle malloc failures or not. Otherwise any write operation on an STL type (like appending to a string) will potentially throw an exception that you need to care about. In the C world this is extremely
236.
by bodyfour 12y ago
Keep in mind these doctors were surrounded by hundreds of cases and potential cases, in field hospitals without even running water. It's quite understandable that they would be at risk even while taking what precautions they could.
237.
by bodyfour 12y ago
That actually surprises me.. I would have guessed that there would be some amount of metadata you could query over the data lines, such as the specs for the DIMM. I guess that's all sent over I2C or something instead?
238.
by bodyfour 12y ago
Or rather, wire up the address pins in any order, and the data pins in any order. A simple RAM chip's inputs were just symmetric. As long as you didn't care what transistor was storing which bit you could wire it how you liked.
239.
by bodyfour 12y ago
> So, if you wanted to only allow recursion via tail-calls, you easily could To be fair, we're talking about a language designed in 1959, where a compiler had to run in 4KB of memory or so. At that point you're barely optimizi
240.
by bodyfour 12y ago
Oh sorry, you're right. I scanned the article too quickly and missed that line.

More ›