8

I would like to find out how do I apply the fix for this vulnerability on cygwin.

I am running the CYGWIN_NT-6.1 MYHOSTNAME 1.7.30(0.272/5/3) 2014-05-23 10:36 x86_64 Cygwin of cygwin on Windows 7.

 #bash -version
 GNU bash, version 4.1.11(2)-release (x86_64-unknown-cygwin)
 Copyright (C) 2009 Free Software Foundation, Inc.
 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>


 $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
 env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
 vulnerable
 this is a test

I tried apt-cyg but it didn't update anything:

    $ apt-cyg update bash
    apt-cyg update bash
    Working directory is /setup
    Mirror is http://mirrors.kernel.org/sourceware/cygwin
    --2014-09-25 09:24:14--          http://mirrors.kernel.org/sourceware/cygwin/x86_64/setup.bz2
    Resolving mirrors.kernel.org (mirrors.kernel.org)... 149.20.4.71, 149.20.20.135,         2001:4f8:1:10:0:1994:3:14, ...
    Connecting to mirrors.kernel.org (mirrors.kernel.org)|149.20.4.71|:80...         connected.
    HTTP request sent, awaiting response... 200 OK
    Length: 431820 (422K) [application/x-bzip2]
    Saving to: ‘setup.bz2’

    100%        [======================================================================================>]         431,820      898KB/s   in 0.5s

    2014-09-25 09:24:14 (898 KB/s) - ‘setup.bz2’ saved [431820/431820]

      Updated setup.ini

when try to reinstall by running setup-x86_64.exe and going through wizard re-install bash that is showing under shell, it seems like start downloading everything. It should be very quick update but it start downloading for over 15 minutes then I canceled it. I looked around https://cygwin.com site and other forum but so far not any specific update for this vulnerability.

  • 1
    Run setup-arch.exe just like the first time you installed it. I did it earlier today. See this Cygwin page – eyoung100 Sep 25 '14 at 16:37
  • @eyoung100 Did it work for you? As you noticed I did that and it seems it was downloading everything and was taking it very long. Although, I selected only bash from the wizard. I like to make sure before overwriting everything – Raza Sep 25 '14 at 16:41
  • It does work, I can post a screenshot for proof, but the update should net you version 4.1.11(5) - release x86_64-unknown-cygwin – eyoung100 Sep 25 '14 at 16:47
  • you word is good enough :). I will let it run for hours to update this. – Raza Sep 25 '14 at 16:48
  • 1
    Then when you re-run setup, you will just re-download the newer versions of everything you deleted. As long as you don't remove your virtual home directory etc you should be OK. I.e. just Remove C:\Cygwin64\Downloads` but not C:\Cygwin64` – eyoung100 Sep 25 '14 at 17:06
6

As per the official Cygwin Installation Page:

Installing and Updating Cygwin for 64-bit versions of Windows

Run setup-x86_64.exe any time you want to update or install a Cygwin package for 64-bit windows. The signature for setup-x86_64.exe can be used to verify the validity of this binary using this public key.

I had a hunch this bash was affected to, so about 15 minutes before you posted your question I did as the setup page instructed.


There is no need for a 3rd Party Script. I believe the process went different for me because I had not cleaned out my Download Directory at C:\Cygwin64\Downloads The setup utility Scanned my currently installed packages, and I left the defaults alone. As such, all packages in the base system were updated. One of these happened to be the bash that is affected by the CVE-2014-6271. You can see proof that you are protected by the following screenshot:

Updated Bash - Cygwin

Please note that I do not know if this update protects against the other vulnerabilities that have been discovered, so please follow the above procedure the next few days until this issue is completely fixed.

2

This looks like the version that patched shellshock (Subject to other bug variations / patches.) for cygwin bash:

Date: Mon, 29 Sep 2014 15:22:43 -0600

https://cygwin.com/ml/cygwin-announce/2014-09/msg00040.html

AKA: 4.1.14-7

" This is a minor rebuild which picks up an upstream patch to fix CVE-2014-7169 and all other ShellShock attacks (4.1.13-6 was also safe, but used a slightly different downstream patch that used '()' instead of '%%' in environment variables, and which was overly restrictive on importing functions whose name was not an identifier). There are still known parser crashers (such as CVE-2014-7186, CVE-2014-7187, and CVE-2014-6277) where upstream will probably issue patches soon; but while those issues can trigger a local crash, they cannot be exploited for escalation of privilege via arbitrary variable contents by this build. Left unpatched, a vulnerable version of bash could allow arbitrary code execution via specially crafted environment variables, and was exploitable through a number of remote services, so it is highly recommended that you upgrade... "

I also had to remove my cygwin download directory before I could pull a newer version of bash via the setup-x86_64.exe. :( So verify with "bash --version" to confirm your patch level.

However, we might not be out of the woods yet...

REF: http://www.zdnet.com/the-shellshock-faq-heres-what-you-need-to-know-7000034219/

" CVE-2014-6277 & CVE-2014-6278: Security researchers discovered two additional bugs. These two bugs are supposed to have the potential for arbitrary command injection, similar to the original Bash bug. However details have not been made public yet, in order to allow appropriate patches to be created. "

CVE-2014-6277

Original release date: 09/27/2014

CVE-2014-6278

Original release date: 09/30/2014

Sigh. Looks like we need to keep a good eye out and keep patching BASH for a bit longer. However you are likely much better at (and after) bash 4.1.14-7 under cygwin.

Hope that helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.