{"id":1282,"date":"2014-09-29T19:55:54","date_gmt":"2014-09-30T01:55:54","guid":{"rendered":"http:\/\/blog.supportpro.com\/?p=1282"},"modified":"2019-10-30T04:25:41","modified_gmt":"2019-10-30T10:25:41","slug":"shell-shock-vulnerability","status":"publish","type":"post","link":"https:\/\/www.supportpro.com\/blog\/shell-shock-vulnerability\/","title":{"rendered":"Shell shock vulnerability"},"content":{"rendered":"

A new vulnerability has been found that potentially affects most versions of the Linux and Unix operating systems, in addition to Mac OS X. Known as the \u201cBash Bug<\/strong>\u201d or \u201cShellShock<\/strong>,\u201d the GNU Bash Remote Code Execution Vulnerability could allow an attacker to gain control over a targeted computer if exploited successfully. And because Bash is everywhere on Linux and Unix-like machines and interacts with all parts of the operating system, everyone anticipates that it will have lot of repercussions.<\/p>\n

How does Shellshock work?<\/strong><\/p>\n

Shellshock exploits a flaw in how Bash parses environment variables; Bash allows functions to be stored in environment variables, but the issue is Bash will execute any code placed after the function in the environment variable value.<\/p>\n

For example, an environment variable setting of VAR=() { ignored; }; \/bin\/id will execute \/bin\/id when the environment is imported into the bash process.
\nI am vulnerable?<\/p>\n

You can check if you’re vulnerable by running the following lines in your default shell.<\/p>\n

env X=”() { :;} ; echo vulnerable” `which bash` -c “echo Check completed”<\/em><\/strong><\/p>\n

If you see the word “vulnerable” echo\u2019d back , then you’re at risk.<\/p>\n

How Shellshock is Impacting the Web ?<\/strong><\/p>\n

The most likely route of attack is through Web servers utilizing CGI (Common Gateway Interface), the widely-used system for generating dynamic Web content. An attacker can potentially use CGI to send a malformed environment variable to a vulnerable Web server. The attacker is able to inject environment variables inside all bash process spawned by a web server under the CGI specification. This will occur directly if the CGI script is programmed in bash or indirectly by system calls inside other types of CGI scripts since the environment will propagate to the sub-shell. The vulnerability will automatically be triggered at the shell process instantiation.\u00a0Furthermore if specific headers are used as attack points, the payload may not appear in the web-server logs, letting a compromise occur with virtually no trace of the intrusion.<\/p>\n

Example:
\nCGI stores the HTTP headers in environment variables. Let’s say the example.com is running a CGI application written in Bash script.<\/p>\n

We can modify the HTTP headers such that it will exploit the shellshock vulnerability in the target server and executes our code.<\/p>\n

curl -k http:\/\/example.com\/cgi-bin\/test -H “User-Agent: () { :;}; echo Hacked > \/tmp\/Hacked.txt”<\/em><\/strong><\/p>\n

Here, the curl is sending request to the target website with the User-Agent containing the exploit code. This code will create a file “Hacked.txt” in the “\/tmp” directory of the server.<\/p>\n

What can I do to protect myself?<\/strong><\/p>\n

Major operating software vendors including RedHaT, CentOS, etc are already released a initial patch for this bug.<\/p>\n

Debian\u2014https:\/\/www.debian.org\/security\/2014\/dsa-3032
\nUbuntu\u2014http:\/\/www.ubuntu.com\/usn\/usn-2362-1\/
\nRed Hat\u2014https:\/\/access.redhat.com\/articles\/1200223*
\nCentOS\u2014http:\/\/centosnow.blogspot.com\/2014\/09\/critical-bash-updates-for-centos-5.html
\nNovell\/SUSE\u2014 http:\/\/support.novell.com\/security\/cve\/CVE-2014-6271.html<\/p>\n

If a patch is unavailable for a specific distribution of Linux or Unix, it is recommended that users switch to an alternative shell until one becomes available.<\/p>\n

Need expert assistance?<\/strong><\/p>\n

SupportPRO<\/strong><\/a> has a team of well experienced professionals. We can check your server for Shellshock vulnerability and patch the server so that you and your customers are secure from this attack. Feel free to contact us if you need assistance.<\/p>\n

If you require help, contact SupportPRO Server Admin<\/a><\/p>\n

\"Server<\/a><\/span>