Keyzer wrote: » My Twitter feed went nuts last night about this.http://arstechnica.com/security/2014/09/bug-in-bash-shell-creates-big-security-hole-on-anything-with-nix-in-it/ I ran the test on my own MacBook Pro (2013 model) and it failed. I'm trying to find more info on how exactly this vulnerability can be exploited.
syklops wrote: » Watch attempts to exploit this on your webservers in real time: tcpdump -s0 -w - -i eth0 port 80 |strings|egrep '\(\).*\{.*:;.*\}' You may need to change eth0 to em1 if you have a new system.
pedro1234 wrote: » Should really watch all ports... Port 80 is only one attack vector.
dublinman1990 wrote: » Hiya folks. I just read on the Mirror website that the bash bug is vulnerable to personal devices in your home such as a set-top box, Smart TV, internet connected smart light bulbs and door locks and internet routers.http://www.mirror.co.uk/news/technology-science/technology/shellshock-bug-your-computer-one-4321560 Say if you have a set top box or Smart TV that is running linux software at home, which ones would be affected by this nasty security bug?
A number of Linux distributions have already issued patches for the flaw, but Insomnia security researcher Adam Boileau warned they may not be complete. “It looks like the patch does not fix every case of environment variables being used to pass on executable code. We are still testing the patch, and hope to have more information on it soon,” Boileau said. A number of other security experts highlighted the incomplete nature of the fix on the Red Hat Bugzilla page. Apple was yet to issue a patch at the time of writing. iTnews found Bash 3.2 in Apple OS X 10.9.5 was vulnerable to Shellshock Shellshock is rated as 10 out of 10 or the highest possible severity rating by the United States National Vulnerability Database. Furthermore, NVD rated Shellshock as a 10 on the scale when it comes to both impact and exploitability.
Rucking_Fetard wrote: » Another POS sh1tbox full of holes bit of software that's been ported all over the place for a quarter of a century that nobody bothered to look at.
Just because a bug was found in open-source does not disprove the "many eyes" theory. Instead, it's bugs being found now that should've been found sometime in the last 25 years. Many eyes are obviously looking at bash now, and they are finding fairly obvious problems. It's obvious that the parsing code in bash is deeply flawed, though any particular bug isn't so obvious. If many eyes had been looking at bash over the past 25 years, these bugs would've been found a long time ago. Thus, we know that "many eyes" haven't been looking at bash.
Rucking_Fetard wrote: » http://www.wired.com/2014/09/shellshocked-bash/
pedro1234 wrote: » That's an awful article. The headline has no bearing on the story.
