Shellshock
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2014-6271 | Arbitrary Code Execution in GNU Bash (Shellshock) GNU Bash through version 4.3 improperly processes trailing strings that follow function definitions inside environment variable values, allowing injected commands to run (CWE-78, OS command injection); this flaw is widely known as 'Shellshock'. An attacker triggers it by supplying a crafted environment variable to any service that invokes Bash, most notably CGI web handlers but also SSH, DHCP clients, and other software that sets variables and spawns the shell. Successful exploitation yields arbitrary code execution with the privileges of the Bash process on the target host. Any Linux, Unix, or similar system running an unpatched Bash through 4.3 is affected, including web servers, appliances, and embedded devices that ship the shell. Exploitation is confirmed in the wild: the flaw is in CISA's KEV (added 2022-01-28) with a required action to apply vendor updates, and EPSS assigns it a 100% probability of exploitation within 30 days, so patching is urgent. Do: Apply Bash updates per your OS vendor's instructions, as required by the CISA KEV listing, ensuring the installed shell is a patched build newer than the unpatched 4.3-era code. Prioritize internet-exposed systems that pass environment variables to Bash, especially CGI-based web servers, and audit embedded appliances and other Linux/Unix hosts that may have been missed by standard patching. | — | 100% | KEV |
| masshundreds of millions of installations, with hundreds of thousands to 1M+ internet-exposed systems | |
| CVE-2014-7169 | Arbitrary Code Execution in GNU Bash via Environment Variables (Shellshock Follow-Up) GNU Bash through version 4.3 incorrectly processes trailing strings appended after function definitions in environment variable values, allowing arbitrary code execution; this CVE tracks the residual flaw that remained after the original Shellshock fix in CVE-2014-6271. It is triggered whenever Bash parses an attacker-controlled environment variable containing a function definition followed by trailing content, a pattern common in CGI-based web services, DHCP clients, SSH forced-command deployments, and other places where Unix shells handle environment data. An attacker who triggers the flaw gains arbitrary command execution with the privileges of the process invoking Bash, which on exposed web or network services can mean direct remote code execution. Any system running Bash 4.3 or earlier is affected, which effectively includes virtually every Linux and Unix deployment plus many embedded and network devices. Exploitation is confirmed: the flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-01-28) and carries a 99.9% EPSS probability of exploitation within 30 days. Do: Apply updated Bash packages from your OS vendor per CISA's required action, ensuring the update addresses both CVE-2014-6271 and this follow-on flaw (CVE-2014-7169). Prioritize internet-facing systems that invoke Bash with attacker-influenced environment variables, such as web servers running CGI scripts and devices processing DHCP or SSH command environments. After patching, verify the fix using your vendor's recommended Shellshock regression test rather than ad-hoc checks. | — | 100% | KEV |
| masshundreds of millions of systems (Bash is the default or ubiquitous shell on Linux/Unix hosts, macOS, and embedded devices) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| sha256 | 2d3e0be24ef668b85ed48e81ebb50dce50612fb8dce96879f80306701bc41614 | llowing ELF binaries have been observed in the wild so far: 2d3e0be24ef668b85ed48e81ebb50dce50612fb8dce96879f80306701bc41614 3b13eef9b24919dc7e7071068a83defcc4808a41dc86fadf039e08dce11 |
| sha256 | 3b13eef9b24919dc7e7071068a83defcc4808a41dc86fadf039e08dce1107f7d | be24ef668b85ed48e81ebb50dce50612fb8dce96879f80306701bc41614 3b13eef9b24919dc7e7071068a83defcc4808a41dc86fadf039e08dce1107f7d 73b0d95541c84965fa42c3e257bb349957b3be626dec9d55efcc6ebcba6 |
| sha256 | 73b0d95541c84965fa42c3e257bb349957b3be626dec9d55efcc6ebcba6fa489 | ef9b24919dc7e7071068a83defcc4808a41dc86fadf039e08dce1107f7d 73b0d95541c84965fa42c3e257bb349957b3be626dec9d55efcc6ebcba6fa489 ae3b4f296957ee0a208003569647f04e585775be1f3992921af996b320c |
| sha256 | ae3b4f296957ee0a208003569647f04e585775be1f3992921af996b320cf520b | 95541c84965fa42c3e257bb349957b3be626dec9d55efcc6ebcba6fa489 ae3b4f296957ee0a208003569647f04e585775be1f3992921af996b320cf520b We'll be writing more on this subject early next week as we |
Full article411 words · extracted from blog.talosintelligence.com · click to collapse
Friday, September 26, 2014 16:44
Shellshock is a serious vulnerability. Bash, arguably the most widely distributed shell on Linux systems, fails to correctly parse environment variables with function declarations. Why the fuss over environment variables? Because these variables are often set by programs that handle network data. Examples include dhcpcd which, through this vulnerability, more or less gives you a remote shell through DHCP option 114 (and potentially others) and Apache using mod_cgi or mod_cgid when CGI scripts are either written in Bash, or otherwise spawn subshells with exported data acquired from untrusted sources -- to name a few.
The problem is located in variables.c
void
initialize_shell_variables (env, privmode)
char **env;
int privmode;
{
[...truncated...]
If an environment variable starts with the string "() {" then initialize_shell_variables() interprets it as a function definition:
if (privmode == 0 && read_but_dont_execute == 0 &&
STREQN ("() {", string, 4))
{
string_length = strlen (string);
temp_string = (char *)xmalloc (3 + string_length + char_index);
strcpy (temp_string, name);
temp_string[char_index] = ' ';
strcpy (temp_string + char_index + 1, string);
To define the bash function, the rest of the string is passed to the parse_and_execute() function.
if (posixly_correct == 0 || legal_identifier (name))
parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST);
The problem here is the rest of the string is assumed to hold only a function definition, and is passed without sanitation to parse_and_execute().
builtins/evalstring.c
/* Parse and execute the commands in STRING. Returns whatever
execute_command () returns. This frees STRING.
[...truncated...]
int
parse_and_execute (string, from_file, flags)
char *string;
[...truncated...]
However, parse_and_execute() does not stop processing when it reaches the end of the function definition. Bash ends up executing all the commands in the string, even after the function definition. In essence, if an attacker can control an environment variable in a program that will spawn a shell with an environment containing that variable, command injection is possible. Since the original discovery of the vulnerability (CVE-2014-6271), the first fix has been found to be incomplete (CVE-2014-7169). Detection for the vulnerability condition (including CVE-2014-6271 & CVE-2014-7169) can be found in SIDs 31975-31978 & SID 31985.
We have observed attacks attempting to load ELF binaries onto possibly vulnerable targets via wget. ClamAV offers protection from this threat under the name "Linux.Flooder.Agent".
The following ELF binaries have been observed in the wild so far:
2d3e0be24ef668b85ed48e81ebb50dce50612fb8dce96879f80306701bc41614
3b13eef9b24919dc7e7071068a83defcc4808a41dc86fadf039e08dce1107f7d
73b0d95541c84965fa42c3e257bb349957b3be626dec9d55efcc6ebcba6fa489
ae3b4f296957ee0a208003569647f04e585775be1f3992921af996b320cf520b
We'll be writing more on this subject early next week as we collect more information about the attacks we are seeing in the wild.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/shellshock-update-bash-immediately/