oss-security - RE: Shellshocker - Repository of "Shellshock" Proof of Concept Code

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sun, 5 Oct 2014 10:22:06 +0000
From: Sona Sarmadi <sona.sarmadi@...a.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: RE: Shellshocker - Repository of "Shellshock" Proof
 of Concept Code

> > < https://github.com/mubix/shellshocker-pocs >
> 
> I mentioned this earlier on another thread, but I would really warn people
> about relying on this unless they really understand what's going on.
> 
> /mz

Thanks Michal, 

I agree that everyone using bash needs to understand what is going on,  but I think what most (non-expert) people need is an explanation for each CVE, a set of test case from some reliable source (preferably a script that runs all test cases and shows vulnerable/not-vulnerable status) and a set of patches. So that they can apply the patches, run the tests and assert that their systems are not vulnerable to shellshock anymore.

Maybe we should update your summary like this:

    CVE-2014-6271 - original RCE found by Stephane. Fixed by bash43-025 and corresponding Sep 24 entries for other versions.
    CVE-2014-7169 - file creation / token consumption bug found by Tavis. Fixed by bash43-026 & co (Sep 26)
    CVE-2014-7186 - a probably no-sec-risk 10+ here-doc crash found by Florian and Todd. Fixed by bash43-028 & co (Oct 1).
    CVE-2014-7187 - a non-crashing, probably no-sec-risk off-by-one found by Florian. Fixed by bash43-028 & co (Oct 1).
    CVE-2014-6277 - uninitialized memory issue, almost certainly RCE found by me. Fixed by bash43-029 & co (Oct 2).
    CVE-2014-6278 - command injection RCE found by me. (No specific patch yet, maybe bash43-30 ??).

Some questions:
 1) bash43-027   patch  exported function namespace change,  Florian's mitigation patch that shields the parser from untrusted inputs". This does not solve any specific CVE, but mitigates all CVEs, is this correct?

2) Do we need to apply *all* of these individual bash patches (i.e. bash43-025 through bash43-029)? Even  bash43-027 which is not solving any specific CVE?  Or should we apply 27 or all the others?

3) Do you have a script or summary of all tests in one place like  http://en.wikipedia.org/wiki/Shellshock_%28software_bug%29 or https://raw.githubusercontent.com/hannob/bashcheck/master/bashcheck ? Or maybe these are good enough & reliable? 

Thanks
/Sona

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.