7

I've been reading up about the remote bash exploit and was wondering how severe it is and if I should be worried, especially since a new exploit has been found after the patch release.

What does this mean for me as someone who uses Debian as my main desktop OS? Is there anything I should be aware of?

3
  • @Patrick - suggest waiting till Mr.Chazelas comes up with a canonical Q&A. Commented Sep 25, 2014 at 13:08
  • Why? This is still a duplicate. And while yes, Chazelas is the finder, that doesn't mean he's the only one who understands the issue.
    – phemmer
    Commented Sep 25, 2014 at 13:11
  • While Stéphane Chazelas can certainly explain well, I wold suggest taking this to the Security SE.
    – peterph
    Commented Sep 25, 2014 at 13:27

1 Answer 1

10

TL;DR (aka executive summary)

  • Yes, you should be worried.
  • Yes, this is severe (giving total strangers potential complete control over your files and resources).

You should definitely upgrade your desktop AS WELL AS any servers.

(https://security.stackexchange.com/questions/68156/is-connecting-to-an-open-wifi-router-with-dhcp-in-linux-susceptible-to-shellshoc)

Your DHCP client uses dhclient-script which uses shell variables passed from the server. If there's a rogue/compromised router, it may pass modified domain-name variables with the exploit.

Credits: Stéphane Chazelas, Mark, Michal Zalewski

In addition, many desktops use OpenSSH, which is definitely vulnerable as per http://seclists.org/oss-sec/2014/q3/650 (although for logged-in users - aka rogue insiders on your network). According to the original reporter of the bug, Stéphane Chazelas, the OpenSSH vulnerability is about bypassing ssh ForcedCommand settings.

Please note, however, that a full fix for the issue is not available yet (http://seclists.org/oss-sec/2014/q3/679).

See https://access.redhat.com/articles/1200223 for possible workarounds. Debian hasn't published the upgrade yet, and I haven't had the time to find a relevant discussion on their site.

(NB: Second a suggestion by terdon; it would be very nice if Stéphane Chazelas could write down a canonical Q&A on Shellshock.)

3
  • 1
    The openssh vulnerability is about bypassing ForcedCommand (like for git deployment or port forwarding setups). If you have shell access to the remote server, it doesn't let you get more privileges. Commented Sep 25, 2014 at 11:34
  • How can this vulnerability be exploited against a desktop user? Commented Sep 26, 2014 at 23:59
  • @DocSalvager - if somebody compromises your router he may be able to attack your PC. Commented Sep 27, 2014 at 3:56

Not the answer you're looking for? Browse other questions tagged .