SHELLSHOCK: Macs, Linux, and Ubuntu face SEVERE security threats

[Goosey 3,017]

MAJOR security flaw in the bash shell was discovered. This shell interacts with the computer via the command promt or terminal (depending on your OS)... it allows for an attacker to insert code into the function.

 

[CHROMATICA 2020 477]

If you've input your password into anything, then yes, you should be. 

Bash servers are currently vulnerable and many sites will be 404'd or 403'd until they patch it.

According to CNET tho, we're all screwed 

[Reza 0]

FOR THOSE OF YOU WISHING TO PATCH VIA XCODE:

 

Open terminal.

Copy and paste this:

mkdir bash-fix

Hit enter.

Next, copy and paste this:

cd bash-fix

Hit Enter.

Now, copy and paste this:

curl https://opensource.apple.com/tarballs/bash/bash-92.tar.gz | tar zxf -

Hit enter.

Next, copy/pasta this:

cd bash-92/bash-3.2

Hit Enter.

Copy and paste this:

cd bash-92/bash-3.2

Hit enter again.

Copy/paste:

curl https://ftp.gnu.org/pub/gnu/bash/bash-3.2-patches/bash32-052 | patch -p0

Hit enter.

Now, copy/paste this:

cd ..

Hit enter.

FINALLY, copy and paste this:

xcodebuild

This will rebuild the bash shell and patch it.

It will just look like a BUNCH of text flying across your screen.

 

At the end, you should see build succeeded.

 

 

 

 

 

Now, let's back up the old bash.

Copy/paste this then hit enter:

sudo cp /bin/bash /bin/bash.old

Copy/paste this then hit enter:

sudo cp /bin/sh /bin/sh.old

Now we have a copy of our old bash just in case.

 

Verify that your bash has changed to 3.2.52 by copy/pasting then hitting enter:

build/Release/bash --version

Copy/paste then hit enter again:

build/Release/sh --version 

It should read: 3.2.52(1)-release.

 

Finally, finish installing the new bash shell.

 

Copy/paste this then hit enter:

sudo cp build/Release/bash /bin

Finally, copy/paste this final line then hit enter.

sudo cp build/Release/sh /bin

One more step!!!

Check to make sure it worked.

Copy and paste the code below:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

You should get the safe result listed in the OP.

 

 

 

 

Detailed guide available at: http://mac-how-to.wonderhowto.com/how-to/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x-0157606/

 

 

 

 

 

 

 

 

 

 

 

 

 

 

It talks to your computer via text.

Imagine text messaging your computer.

Then one day it tells you that you're a b---h and to go screw yourself and that it's sending those private conversations that you and she had to everyone in school. All your text messages leak.

 

In this case, all your private data like passwords can leak and be stored.

[Nemo 4,410]

It's not clear to me why an HTTP request header would ever be passed to bash, unless maybe the web server was calling a CGI script. So I think I need more info on this. I don't claim to know the inner workings of Apache; maybe it does stupid stuff like that?

At any rate, unless you're running a server off of your machine, this doesn't appear to be relevant to you. Also, I really don't think ordinary non-programmer users should be directed to Xcode. The point of that procedure (grabbing source and building it yourself) is just to ensure the provenance of all the code -- which is perhaps the kind of thing that makes sense for a web server admin. Regular users could be content to grab a pre-built bash binary from a trusted source, or just wait, since frankly it doesn't impact them anyway.

[Mr Josh 3]

Did the Xcode fix yesterday thanks to a good sis on MacRumors. Although I don't think it's needed at all for your average user.

[Devotion 0]

i have windows, will this happen 2 me 

[Mr Josh 3]

i have windows, will this happen 2 me 

no

[CHROMATICA 2020 477]

Apple is going to release an update soon

[SychosSoChic 9,995]

Apple is going to release an update soon

 

Thank Gaga   I was panicking 

[CHROMATICA 2020 477]

Thank Gaga   I was panicking 

Me too! It's on the MacRumors website, but it's true they're releasing the update lol. It might be rolled out with OS X Yosemite or a standalone update. 

[SychosSoChic 9,995]

Me too! It's on the MacRumors website, but it's true they're releasing the update lol. It might be rolled out with OS X Yosemite or a standalone update. 

 

But if this has been around for 60 years and nothing bad has happened to most of us then I'm not sure there's much to worry about   I mean fix it. Fix it now, but just don't panic.

 

But now that it's on the news and all this news is out there for hackers everywhere to see they'll probably start hacking us 

[Sunny 12,753]

I have windows

[Reza 0]

It's not clear to me why an HTTP request header would ever be passed to bash, unless maybe the web server was calling a CGI script. So I think I need more info on this. I don't claim to know the inner workings of Apache; maybe it does stupid stuff like that?

At any rate, unless you're running a server off of your machine, this doesn't appear to be relevant to you. Also, I really don't think ordinary non-programmer users should be directed to Xcode. The point of that procedure (grabbing source and building it yourself) is just to ensure the provenance of all the code -- which is perhaps the kind of thing that makes sense for a web server admin. Regular users could be content to grab a pre-built bash binary from a trusted source, or just wait, since frankly it doesn't impact them anyway.

 

The issue with the Apache servers is that when they run the CGI script, it can affect both the user as well as the server calling the script. Cygwin is also affected in Windows due to the CGI script failure to declare the variable, and instead defines it. 

The issue with the newer CGIs and also scripts in generally is that some genius decided: 

"Let's just make these dynamic and let the scripts run individually on individual computers and allow them to call the processes via this bin." Now whenever a regular user connects to one of these servers that calls upon the bash shell, the bash shell is running processes on their own computer instead of simply running the process via the server. 

 

Now let's say you have a directory and in that directory, you intentionally insert a malicious file and the user, when connecting to your site, calls upon that directory. Whatever is placed in there is read and executed, and if it happens to be a worm, a keylogger, or a zip file, which is unzipped and executed, then the user also suffers. 

 

I have windows

 

That's affected too. 

Cygwin is also affected.

But if this has been around for 60 years and nothing bad has happened to most of us then I'm not sure there's much to worry about   I mean fix it. Fix it now, but just don't panic.

 

But now that it's on the news and all this news is out there for hackers everywhere to see they'll probably start hacking us 

 

There are rumors of more scripts being in the wild.

I already posted on that preys on a kernel's weakness via this exploit and attempts to guess easy passwords.

[Reza 0]

no

 

Not true.

[Nemo 4,410]

The issue with the newer CGIs and also scripts in generally is that some genius decided: 

"Let's just make these dynamic and let the scripts run individually on individual computers and allow them to call the processes via this bin." Now whenever a regular user connects to one of these servers that calls upon the bash shell, the bash shell is running processes on their own computer instead of simply running the process via the server.

Please stop talking nonsense. CGI does not work that way.