Page 1 of 1

shellshock -- thank you for the quick fix!

Posted: Thu Sep 25, 2014 1:31 pm
by dliloch
This morning after reading the news about shellshock .. and trying this script..that I found on stack exchange

http://apple.stackexchange.com/question ... 851#146851

env x='() { :;}; echo vulnerable' bash -c 'echo hello'
I see my apple is still vulnerable no fix yet.. but by updating the pi.. all is good.. thanks for the quick response to this.. .

Re: shellshock -- thank you for the quick fix!

Posted: Thu Sep 25, 2014 4:17 pm
by 7ewis
Could someone explain to me why this doesn't run, and how it could be dangerous, in simple terms?

Obviously I know if you can execute random code remotely; it's bad. But specifically in this context?

When you run the code, after the error messages, it still says 'hello' at the end anyway. But I read somewhere that the code at the end is where someone would put something malicious?

Re: shellshock -- thank you for the quick fix!

Posted: Thu Sep 25, 2014 4:23 pm
by rpdom
It's not the code at the end of the line that is the problem. That bit is the "good" code and is supposed to run. The bad bit is on the end of the function definition x='() { :;}; echo vulnerable'. The function is { :;}, which is just a dummy function and does nothing. The "echo vulnerable" is a bit of code that shouldn't be there and should be rejected or ignored, but it gets executed instead.

What you can do is to include the function definition in a request for a page on a web server (for example) that runs a cgi script. The function will be ignored, but the "bad" code will be executed by the web server without checking what it does first.

Re: shellshock -- thank you for the quick fix!

Posted: Thu Sep 25, 2014 5:06 pm
by ShiftPlusOne
Too many shellshock threads.

Re: shellshock -- thank you for the quick fix!

Posted: Fri Sep 26, 2014 12:54 am
by plugwash
Please see http://www.raspberrypi.org/forums/viewt ... 66&t=87812

Note that the first round of fixing did not fully fix the bug.