212

bash stores exported function definitions as environment variables. Exported functions look like this: $ foo() { bar; } $ export -f foo $ env | grep -A1 foo foo=() { bar } That is, the environment variable foo has the literal contents: () { bar } When a new instance of bash launches, it looks for these specially crafted environment variables, and ...


86

This may help to further demonstrate what is going on: $ export dummy='() { echo "hi"; }; echo "pwned"' $ bash pwned $ If you are running a vulnerable shell, then when you start a new subshell (here, simply by using the bash statement), you will see that the arbitrary code (echo "pwned") is immediately executed as part of its initiation. Apparently, the ...


72

I wrote this as a tutorial-style recasting of the excellent answer by Chris Down above. In bash you can have shell variables like this $ t="hi there" $ echo $t hi there $ By default, these variables are not inherited by child processes. $ bash $ echo $t $ exit But if you mark them for export, bash will set a flag that means they will go into the ...


23

To reassure a few, I didn't find the bug by observing exploits, I have no reason to believe it's been exploited before being disclosed (though of course I can't rule it out). I did not find it by looking at bash's code either. I can't say I remember exactly my train of thoughts at the time. That more or less came from some reflection on some behaviours of ...


22

This is not an issue for OpenSSH since it doesn't make use of SSL. excerpt - What is the difference between SSL vs SSH? Which is more secure? They differ on the things which are around the tunnel. SSL traditionally uses X.509 certificates for announcing server and client public keys; SSH has its own format. Also, SSH comes with a set of protocols ...


20

Answer to my question, from Qualys: During our testing, we developed a proof-of-concept in which we send a specially created e-mail to a mail server and can get a remote shell to the Linux machine. This bypasses all existing protections (like ASLR, PIE and NX) on both 32-bit and 64-bit systems. My compiled research below for anyone else looking: ...


20

If you can feed arbitrary environment variables to a program, you can cause it to do just about anything by having it load libraries of your choosing. In most cases this is not considered a vulnerability in the program receiving those environment variables, but rather in the mechanism by which an outsider could feed in arbitrary environment variables. ...


19

The coordinated disclosure date for the BlueBorne vulnerabilities was September 12, 2017; you should see distribution updates with fixes for the issues shortly thereafter. For example: RHEL Debian CVE-2017-1000250 and CVE-2017-1000251 Until you can update the kernel and BlueZ on affected systems, you can mitigate the issue by disabling Bluetooth (which ...


18

The clearest post I’ve seen on this issue is Matthew Garrett’s (including the comments). Matthew has now released a tool to check your system locally: build it, run it with sudo ./mei-amt-check and it will report whether AMT is enabled and provisioned, and if it is, the firmware versions (see below). The README has more details. To scan your network for ...


12

Alan Cox shared a link from AMD's blog: https://www.amd.com/en/corporate/speculative-execution Variant One: Bounds Check Bypass Resolved by software / OS updates to be made available by system vendors and manufacturers. Negligible performance impact expected. Variant Two: Branch Target Injection Differences in AMD architecture mean there is a near ...


11

January 27, 2018 Intel Microcode breaks some systems The Intel Microcode Update 2018-01-08 to address speculative execution branching security holes broke some systems. This effected many Ubuntu systems from January 8th to January 21st. On January 22, 2018 Ubuntu released an update that puts back older Microcode from 2017-07-07. If you experienced problems ...


11

No, you could not say it's safe. https://www.ibm.com/blogs/psirt/potential-impact-processors-power-family/ Complete mitigation of this vulnerability for Power Systems clients involves installing patches to both system firmware and operating systems. The firmware patch provides partial remediation to these vulnerabilities and is a pre-requisite for the OS ...


11

CentOS is just rebuilt RHEL so your system is safe, if you updated to openssh-7.4p1-16.el7 or similar that is shipped in CentOS 7. There is CVE database in Red Hat access portal: https://access.redhat.com/security/cve/cve-2017-15906 With links to the erratas fixing the issues and with listing of packages fixing the specific issue: https://access.redhat....


10

According to LWN there is a mitigation which can be used while you do not have a patched kernel: there is a mitigation available in the form of the tcp_challenge_ack_limit sysctl knob. Setting that value to something enormous (e.g. 999999999) will make it much harder for attackers to exploit the flaw. You should set it by creating a file in /etc/...


9

It is explained in the article you linked ... you can create environment variables with specially-crafted values before calling the bash shell. These variables can contain code, which gets executed as soon as the shell is invoked. Which means the bash that is called with -c "echo this is a test" executes the the code in the single quotes when it is ...


8

Simply detecting the open ports for this service is insufficient, it doesn't indicate if the version is affected or not. Our team has created a python script available at our github : CerberusSecurity/CVE-2017-5689 that detects if a target system is vulnerable to remote attack. Sample usage: python CVE_2017_5689_detector.py 10.100.33.252-255 This should ...


7

Got fixed in 7.4p1-16, way back in November 2017. $ rpm -q openssh-server openssh-server-7.4p1-16.el7.x86_64 $ rpm -q --changelog openssh-server | grep CVE-2017-15906 - Fix for CVE-2017-15906 (#1517226) $ rpm -q --changelog openssh-server | head * Fri Nov 24 2017 Jakub Jelen <jjelen@redhat.com> - 7.4p1-16 + 0.10.3-2 - Fix for CVE-2017-15906 (#1517226) ...


6

You tagged this question debian, so I will assume that you are running a Linux-based Debian system. The relevant patch that fixes this bug is small and relatively isolated, making it a prime candidate for backporting. Debian is usually quite good about backporting security-related fixes to the software versions that they are shipping on supported ...


6

To get updates on older releases you will probably need to add the Debian 6.0 (Squeeze) LTS repository to your sources.list. To add this repository, edit /etc/apt/sources.list and add the following line to the end of the file. deb http://ftp.us.debian.org/debian squeeze-lts main non-free contrib Then run: apt-get update You should see some new ...


6

This flaw can be exploited remotely by visiting a JavaScript website. Indeed. So, one sensible mitigation is to disable JavaScript in your web browsers, or to use web browsers that do not support JavaScript. Most browsers that do support JavaScript have a setting for disabling it. Alternatively, if you wish to maintain a whitelist of sites or domains for ...


5

The fact that this is exploitable using JavaScript isn't the main point, and shouldn't be the main concern (although it is a major one because this way remote code can easily be executed on your system, but this isn't the only way this can happen). Your focus shouldn't lie on Javascript and/or your browser. Ideally, your CPU should be patched. Unfortunately,...


5

gpg --passphrase $my_passphrase My question: is this safe? Will the variable $my_passphrase and/or the decrypted output be visible/accessible in some way? No, that's not really considered safe. The passphrase will be visible in the output of ps, just like all other running processes' command lines. The data itself will not be visible, the pipe is not ...


4

This kind of problem is inevitable. Or, at least, it is doubly probable. When people talk about grub as a necessity they almost always bring up things like keeping the kernel image on an encrypted disk, or SecureBoot keys. They usually say that you couldn't handle those things otherwise, that you need an intermediate loader in your boot process to interface ...


4

Because of the specific nature of Meltdown, Power is not affected by the demonstration code, but it may be possible to write something that has a similar effect. But, because of the way that AIX on Power organizes it's memory map, only one page (IIRC, it's a while since I last looked) of the kernel (page 0, the one containing the interrupt vectors) is mapped ...


4

Can I do anything further to protect my system, and if so, what should my next steps be? You can do something further to protect your system: you can disable SMT (hyperthreading). This is usually possible in your system’s firmware setup. Do I need to take action regarding my Microarchitectural Data Sampling (MDS) status? That depends on what you use ...


4

A number of kernel boot parameters are available to disable or fine-tune hardware vulnerability mitigations: for Spectre v1 and v2: nospectre_v1 (x86, PowerPC), nospectre_v2 (x86, PowerPC, S/390, ARM64), spectre_v2_user=off (x86) for SSB: spec_store_bypass_disable=off (x86, PowerPC), ssbd=force-off (ARM64) for L1TF: l1tf=off (x86) for MDS: mds=off (x86) for ...


4

With a kernel 5.1.13 or newer : On boot parameter you can use mitigations=off With a kernel older than 5.1.13 : noibrs noibpb nopti nospectre_v2 nospectre_v1 l1tf=off nospec_store_bypass_disable no_stf_barrier mds=off mitigations=off Add either mitigations=off or that long one-liner to your /etc/sysconfig/grub and re-generate grub's configuration file ...


3

Intel has tools for linux at : Linux Detection and Mitigation Tools there is a fork of it at GITHUB


3

You could simply read documentation on this vulnerability and update instructions. E.g. redhat provides extremely detailed information: Do I need to reboot or restart services after installing the update for CVE-2014-6271 and CVE-2014-7169? If your system uses exported Bash functions, restarting affected services is recommended. Affected ...


Only top voted, non community-wiki answers of a minimum length are eligible