Bash "shellshock" CVE-2014-6271 CVE-2014-7169 - Bash Bug Fix

bplphp73 · 09-25-2014, 10:02 PM

Is there source code to build a patched version of bash that can be used with slackware 12?

mancha · 09-25-2014, 10:51 PM

Quote:

Originally Posted by RickKnight

Any word on a patch for 12.0? I checked packages.slackware.com and didn't see one. I have a mail server running on 12.0 and am not ready to upgrade yet.

Quote:

Originally Posted by bplphp73

Is there source code to build a patched version of bash that can be used with slackware 12?

Hi.

Slackware 12.0 through 12.2 ship Bash 3.1. You should be able to use Slackware 13.0's build files on 12.x and be "protected". At least
until someone finds the next way to breach the parser.

--mancha

Smokey_justme · 09-25-2014, 11:41 PM

Quote:

Originally Posted by metaschima

Code:

bash-4.2$ env X='() { (a)=>\' sh -c "echo date"; cat echo
sh: X: line 1: syntax error near unexpected token `='
sh: X: line 1: `'
sh: error importing function definition for `X'
Thu Sep 25 13:49:24 CDT 2014

Does this mean it worked ?

Yes.. To understand it better, after running that line try running

Code:

cat echo

in that directory (or look for the file) and it will show you the date...

WiseDraco · 09-26-2014, 03:06 AM

Quote:

Originally Posted by hitest

Praise Bob. Patched my four Slackware boxes yesterday.

can you give us a link?

commandlinegamer · 09-26-2014, 04:54 AM

Quote:

Originally Posted by WiseDraco

can you give us a link?

A Slackware mirror.

willysr · 09-26-2014, 06:38 AM

Just to give some info, the updated package in current do not contain the patch as the SlackBuild is not yet modified to include the patch (eol-pushback.patch). Probably Pat forgot to add it and hopefully will issue another rebuilt soon

enorbet · 09-26-2014, 09:44 AM

Guys be forewarned, one patch is not enough. There are now 3 patches released and I wouldn't be surprised if more occur. It's being called ShellShock and worse than HeartBleed.

mancha · 09-26-2014, 10:47 AM

I just wrote up a post with details on how to harden Bash to help protect from yet-to-be-discovered ways to abuse environment variables
as well as two new out-of-bounds memory issues.

My post has links to patches I've packaged for Bash 3.1, 4.1, 4.2, and 4.3.

--mancha

rg3 · 09-26-2014, 11:43 AM

Thanks mancha for your work and involvement in the security community.

Just to clarify, I'm running slackware64-current and I have already installed the updates from "Thu Sep 25 19:55:13 UTC 2014", which includes the package "bash-4.3.025-x86_64-2". I can still run:

Code:

env X='() { (a)=>\' sh -c "echo date"; cat echo

A file named "echo" is created in the current directory containing the date. Is that normal or should that be fixed? Will a future update fix that kind of behavior? Thanks in advance.

Smokey_justme · 09-26-2014, 12:12 PM

@rg3: That means the version is still exploitable by yacc-attack...

Try recompiling with this patch for bash 4.3 (the link is taken from mancha's post)

The correct (exploit-free) output should be something like:

Code:

$ env X='() { (a)=>\' sh -c "echo date"; cat echo
sh: X: line 1: syntax error near unexpected token `='
sh: X: line 1: `'
sh: error importing function definition for `X'
date
cat: echo: No such file or directory

P.S. Be sure you delete the file "echo" before retrying the command and that you are in a writable directory (this should go without saying but stuff like this always bite me *blush*)

P.P.S. bash-4.2.045-i486-1 from Slackware 14.1 is unnafected by both RCE and yacc-attack vulnerability, but it is affected by the out-of-bounds memory issues from post #227

thirdm · 09-26-2014, 12:24 PM

Quote:

Originally Posted by Smokey_justme

@rg3: That means the version is still exploitable by yacc-attack...

Try recompiling with this patch for bash 4.3 (the link is taken from mancha's post)

Ahem. Do you really want that? I'm not saying I see problems in the patch, but it's more than a few lines of moderately complicated string handling (the minimum complexity of string handling in C) combined with memory allocation. And it was all whipped up, uh, yesterday during all this excitement. Maybe people should slow down a little, that's all I'm saying.

Smokey_justme · 09-26-2014, 12:37 PM

Unfortunetly, loss of functionality or introducing some minor bug is more safer than letting the exploit unfixed...

thirdm · 09-26-2014, 12:42 PM

A minor bug wasn't what I was concerned about. Recall this summer when someone demonstrated an exploit with a bounds error of only one byte.

rg3 · 09-26-2014, 01:00 PM

Thanks for the replies. I didn't mean to start a discussion. I just find confusing that in sites like https://shellshocker.net/ (currently in the main page of Hacker News), the second vulnerability CVE-2014-7169 is tested with the following code:

Code:

env X='() { (a)=>\' bash -c "echo date"; cat echo

Which still exposes buggy behavior on my slackware64-current system, and it's supposed to be fixed with the package "bash-4.3.025-x86_64-2".

willysr · 09-26-2014, 01:11 PM

if you look at the bash slackbuild in current, the patch (eol-pushback.patch) is not used, so it's still vulnerable