maemo.org - Talk - Sailfish OS bash shell is affected by the #shellshock bug

Page 1 of 2

Next >

Show 40 post(s) from this thread on one page

maemo.org - Talk (https://talk.maemo.org/index.php)

- SailfishOS (https://talk.maemo.org/forumdisplay.php?f=52)

- - Sailfish OS bash shell is affected by the #shellshock bug (https://talk.maemo.org/showthread.php?t=93922)

Bundyo

2014-09-25 07:06

Sailfish OS bash shell is affected by the #shellshock bug

Pretty nasty this fella, here is more info and a test:

http://prng.net/shellshock/

I also filed a bug report @together, please vote:
https://together.jolla.com/question/...hellshock-bug/

coderus

2014-09-25 07:40

Re: Sailfish OS bash shell is affected by the #shellshock bug

fix will be included in upcoming sailfish update, you can be sure ;)

javispedro

2014-09-25 08:18

Re: Sailfish OS bash shell is affected by the #shellshock bug

So how exactly do you plan to exploit this vulnerability on Jolla?

What I would like to see is an upgrade to GPLv3 Bash4, instead of wasting more time on their bash3 fork.

LouisDK

2014-09-25 08:23

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by javispedro (Post 1440469)

So how exactly do you plan to exploit this vulnerability on Jolla?

What I would like to see is an upgrade to GPLv3 Bash4, instead of wasting more time on their bash3 fork.

Do they still use Bash3 and why? Are they scared of GPLv3 software like Apple are?

coderus

2014-09-25 08:28

Re: Sailfish OS bash shell is affected by the #shellshock bug

@javispedro there are should be some internals accepting environment variables.

javispedro

2014-09-25 08:39

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by LouisDK (Post 1440470)

Do they still use Bash3 and why? Are they scared of GPLv3 software like Apple are?

Yes, they use an ancient non-GPLv3 version of Bash. I don't understand why and tbh it's my primary complaint against Jolla.

Quote:

Originally Posted by coderus (Post 1440471)

@javispedro there are should be some internals accepting environment variables.

So..? At this moment the only way I can think of to exploit this right now would be a suid binary that goes its way around bash "don't-run-me-suid" protection (e.g. set{e}uid then system). Which would be pretty nasty in itself since there's another 300 ways to attack those. So if you know one of those please report it.

Virtually the only situations where this bug can cause trouble is everywhere where a backlist/whitelist of environment variables is used to filter out such variables by name only. Because with this bug there are no "safe" env variable names.

nieldk

2014-09-25 09:17

Re: Sailfish OS bash shell is affected by the #shellshock bug

Well, You are probably right, but this is exploitable on several applications aswell. There is a bit more here http://seclists.org/oss-sec/2014/q3/650.

So, applications that expose some of the functionality that is vulnerable (abitrary environment variables) could be used to get at least shell code execution as current user.

But, that being said, I agree, I dont consider this a huge threat to Jolla/SailfishOS

javispedro

2014-09-25 09:29

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by nieldk (Post 1440478)

So, applications that expose some of the functionality that is vulnerable (abitrary environment variables) could be used to get at least shell code execution as current user.

Yes, you defined it the way I see it. So if you could think of _anywhere_ in which this situation happens on a Jolla or even a normal workstation* then there might be a problem. Otherwise this is not exploitable at all.

*No, running sshd alone does not mean you're vulnerable. If on the other hand you were expecting that people ssh'ing would not be able to run arbitrary code you're in for a nasty surprise (e.g. stupid centralized Git servers, sftp-only servers -- shared hosting, etc.)

coderus

2014-09-25 09:32

Re: Sailfish OS bash shell is affected by the #shellshock bug

anyway, waiting for bash update in nieldk repo :)

javispedro

2014-09-25 10:25

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by coderus (Post 1440484)

anyway, waiting for bash update in nieldk repo :)

Wow, so you will be installing a random RPM package? Did you know the package could contain a RPM pre/post install script which could:
1) Grab all of your address book contacts,
2) Send compromising SMSs to all of them (plus a few "premium service" SMSs to inflate your bills!),
3) Zip your documents folder and upload to some chinese WWW server,
4) Then proceed to write randomly over your eMMC _permanently_ bricking the Jolla.

#securityscare ;)

The JollaStore RPM packages are somewhat safer, but only because they are manually/statically analyzed.

Just an example of why I think "security scares" are bad. People tend to misplace their fears...

Bundyo

2014-09-25 10:34

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by javispedro (Post 1440469)

So how exactly do you plan to exploit this vulnerability on Jolla?

What I would like to see is an upgrade to GPLv3 Bash4, instead of wasting more time on their bash3 fork.

Probably like this, check the Internet Scans section:
http://www.volexity.com/blog/?p=19

javispedro

2014-09-25 10:39

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by Bundyo (Post 1440491)

Probably like this, check the Internet Scans section:
http://www.volexity.com/blog/?p=19

But do you run a webserver on your Jolla? That can run CGI scripts? :)

Bundyo

2014-09-25 10:41

Re: Sailfish OS bash shell is affected by the #shellshock bug

Not yet :D

nieldk

2014-09-25 10:48

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by javispedro (Post 1440493)

But do you run a webserver on your Jolla? That can run CGI scripts? :)

Ehh, yes ;)

coderus

2014-09-25 11:01

Re: Sailfish OS bash shell is affected by the #shellshock bug

@javispedro #paranoiaeverywhere, lol

vincr

2014-09-25 13:04

Re: Sailfish OS bash shell is affected by the #shellshock bug

Wrong subforum, but what about Maemo and Meego? These OS'es are infected too with this bug isn't it?

nieldk

2014-09-25 13:38

Re: Sailfish OS bash shell is affected by the #shellshock bug

1 Attachment(s)

Quote:

Originally Posted by coderus (Post 1440484)

anyway, waiting for bash update in nieldk repo :)

Wont have to wait long ;)

Edit: https://openrepos.net/content/nieldk/bash

patchlevel 25, which fixes #shellschock

source (and binaries)
https://build.merproject.org/package...elnielsen/bash

MartinK

2014-09-25 14:49

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by javispedro (Post 1440490)

The JollaStore RPM packages are somewhat safer, but only because they are manually/statically analyzed.

Yeah, but as people are expected to publish compiled binaries, any QAed application can still every April 1 grab all your pictures and post them to Imgur. :) And the store QA has no realistic chance to find about this beforehand.

Still better than running as root, but there is still a lot of sensitive content accessible to unpriviledged accounts & full network access for all apps.

Drekkie

2014-09-25 16:17

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by vincr (Post 1440505)

Wrong subforum, but what about Maemo and Meego? These OS'es are infected too with this bug isn't it?

When I ran the test command on my N9 it showed it was affected. I don't run a web server on it but I would be interested if there is any way to patch the N9 and N900 (haven't tested) once the mainstream patches get sorted.

pichlo

2014-09-25 17:43

Re: Sailfish OS bash shell is affected by the #shellshock bug

Just tested on my N900 (Bash4).

Code:

~ $ env x='() { :;}; echo vulnerable'  

bash -c "echo this is a test"

vulnerable

this is a test

~ $

Quote:

Originally Posted by MartinK (Post 1440509)

Still better than running as root

http://imgs.xkcd.com/comics/authorization.png

(Source: http://xkcd.com/1200/)

szopin

2014-09-25 19:21

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by pichlo (Post 1440542)

Just tested on my N900 (Bash4).

Code:

~ $ env x='() { :;}; echo vulnerable'  

bash -c "echo this is a test"

vulnerable

this is a test

~ $

So just uninstall bash, busybox with sh is safe

Probably more worrying for n900 is the apt-get vulnerability (do you apt-get upgrade vulnerable apt-get to get safe apt-get???), didn't see a thread about it:
https://lists.debian.org/debian-secu.../msg00212.html
https://lists.debian.org/debian-secu.../msg00216.html
https://lists.debian.org/debian-secu.../msg00219.html

szopin

2014-09-25 19:33

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by coderus (Post 1440464)

fix will be included in upcoming sailfish update, you can be sure ;)

Wouldn't bet too much money on that. Original patch had some issues (rather quickly someone came with an example how to still exploit it, though supposedly less severely), most opinions are that there will be a few patches as people come up with more examples. At least some patch I hope will be delivered

Bundyo

2014-09-25 19:51

Re: Sailfish OS bash shell is affected by the #shellshock bug

https://together.jolla.com/question/...#post-id-56855

This is the official answer, the thread was closed :)

Oh, some gory details on the first 0day exploit malware (botnet it seems):
http://www.kernelmode.info/forum/vie...&t=3505#p23987

javispedro

2014-09-25 20:05

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by vincr (Post 1440505)

Wrong subforum, but what about Maemo and Meego? These OS'es are infected too with this bug isn't it?

Since no Maemo originally shipped bash, you can be certainly sure no script is using it (unless you replaced /bin/sh with bash but I know for sure that didn't work on Fremantle). So it's also not exploitable.

szopin

2014-09-25 21:03

Re: Sailfish OS bash shell is affected by the #shellshock bug

developing: http://seclists.org/oss-sec/2014/q3/712

vincr

2014-09-25 21:59

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by javispedro (Post 1440565)

I have bash on my N9 and it's vulnerable.. hope to see some patched bash in openrepos. Just to be sure it's safe. :rolleyes:

LadyBug

2014-09-26 07:20

Re: Sailfish OS bash shell is affected by the #shellshock bug

If someone is curious how shellshock could be used to attack a Sailfish device, this illustrates one attack vector: https://pbs.twimg.com/media/ByZZUzmIIAAuFaR.jpg:large

That is, a malicious DHCP server could attack by sending code in the options field. I haven't verified this with my Jolla, but in theory this could be bad. Think of public WIFI access points...

Manatus

2014-09-26 08:17

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by vincr (Post 1440583)

I have bash on my N9 and it's vulnerable.. hope to see some patched bash in openrepos. Just to be sure it's safe. :rolleyes:

For time being you can 'apt-get remove' bash. Of course depending on what software you run; on my N9 Schturman's N9 QTweak was only application using it. N9 QTweak reinstalls bash during the application launch, though.

nieldk

2014-09-26 08:25

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by LadyBug (Post 1440616)

Nice one!

Feel free to test that with my bash ;)
http://talk.maemo.org/showpost.php?p...6&postcount=17

javispedro

2014-09-26 09:26

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by LadyBug (Post 1440616)

Jolla doesn't use dhclient; it uses connman's builtin gdhcp client.

EDIT: Again, during "security crazes" please remember to keep your brain turned on. There's a shitton of people (e.g. stackoverflow) who is right now posting "instructions to solve the bash bug" which include absurd things such as replacing your distro's bash with some random online version. Without proper care, that's even more stupid than plainly doing nothing.

This doesn't necessarily apply to nieldk's packages, which I think one can trust (hehe ;P), but please remember to be generally cautious about this.

nieldk

2014-09-26 09:34

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by javispedro (Post 1440635)

Jolla doesn't use dhclient; it uses connman's builtin gdhcp client.

Will test later when I am at home on my linux box :)

Quote:

EDIT: Again, during "security crazes" please remember to keep your brain turned on. There's a shitton of people (e.g. stackoverflow) who is right now posting "instructions to solve the bash bug" which include absurd things such as replacing your distro's bash with some random online version. Without proper care, that's even more stupid than plainly doing nothing.

Absolutely true!

Quote:

This doesn't necessarily apply to nieldk's packages, which I think one can trust (hehe ;P), but please remember to be generally cautious about this.

:P only if You can trust 1) gnu sources 2) mer buildengine

Bundyo

2014-09-26 16:31

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by LadyBug (Post 1440616)

Here is the whole page:
https://www.trustedsec.com/september...proof-concept/

HtheB

2014-09-26 17:25

Re: Sailfish OS bash shell is affected by the #shellshock bug

why do I keep thinking of Turtles in Time (for the SNES) when I read 'Shellshock'?
(when you died, it said 'shellshock'. good old times)

LouisDK

2014-09-26 20:05

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by Bundyo (Post 1440564)

https://together.jolla.com/question/...#post-id-56855

This is the official answer, the thread was closed :)

Closing a bug report before the bug is fixed is not a good idea if you ask me.

gerbick

2014-09-26 20:49

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by HtheB (Post 1440701)

why do I keep thinking of Turtles in Time (for the SNES) when I read 'Shellshock'?
(when you died, it said 'shellshock'. good old times)

That game was good and hard; the good kind of frustrating hard. Damn you... now I want to play it again...

javispedro

2014-09-27 00:04

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by nieldk (Post 1440636)

Will test later when I am at home on my linux box :

Try to write to a file in /tmp since you're not going to easily know where stdout from connman is redirected.

rainisto

2014-09-27 08:09

Re: Sailfish OS bash shell is affected by the #shellshock bug

gdhcp is not setting any env variables, so it should not be vulnerable. But if you manage to find an exploit then feel free to send steps to reproduce email to security@jolla.com

nieldk

2014-09-27 11:42

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by rainisto (Post 1440771)

gdhcp is not setting any env variables, so it should not be vulnerable. But if you manage to find an exploit then feel free to send steps to reproduce email to security@jolla.com

seems true, I couldnt use dhcp to trick connman exploit, neither with included bash, or my build

nieldk

2014-09-27 11:52

Re: Sailfish OS bash shell is affected by the #shellshock bug

internet of things - worth a reading

http://paste.lisp.org/display/143864

juiceme

2014-09-27 14:00

Re: Sailfish OS bash shell is affected by the #shellshock bug

Quote:

Originally Posted by nieldk (Post 1440789)

internet of things - worth a reading

http://paste.lisp.org/display/143864

All so true. Yet, this is something that happens all over again, whether the used components are FFOS or developed in-house. Sometimes a first-implemented solution works so well that proper break-in testing is not done... usually because of not enough time[*].

[*] There's never enough time to do things properly, but always time to fix them later

All times are GMT. The time now is 04:19.

Page 1 of 2

Next >

Show 40 post(s) from this thread on one page

vBulletin® Version 3.8.8