Content deleted Content added
→Patches: clarify source code |
rvv |
||
| (8 intermediate revisions by 7 users not shown) | |||
Line 16:
}}
'''Shellshock''', also known as '''Bashdoor''',<ref name="NYT-20140925-NP">{{cite news |last=Perlroth |first=Nicole |title=Security Experts Expect 'Shellshock' Software Bug in Bash to Be Significant |url=https://www.nytimes.com/2014/09/26/technology/security-experts-expect-shellshock-software-bug-to-be-significant.html |date=25 September 2014 |work=[[New York Times]] |access-date=25 September 2014 }}</ref> is a family of [[security bug]]s<ref name="TSM-20140927">Although described in some sources as a "virus," Shellshock is instead a design flaw in a program that comes with some operating systems. See => {{cite web |author=Staff |title=What does the "Shellshock" bug affect? |url=
On 12 September 2014, Stéphane Chazelas informed Bash's maintainer Chet Ramey<ref name="NYT-20140925-NP" /> of his discovery of the original bug, which he called "Bashdoor". Working with security experts, Mr. Chazelas developed a [[Patch (computing)|patch]]<ref name="NYT-20140925-NP" /> (fix) for the issue, which by then had been assigned the vulnerability identifier ''{{CVE|2014-6271}}''.<ref name="seclist-q3-650">{{cite mailing list|url=http://seclists.org/oss-sec/2014/q3/650 |mailing-list=oss-sec |title=Re: CVE-2014-6271: remote code execution through bash|author=Florian Weimer|date=24 September 2014|access-date=1 November 2014}}</ref> The existence of the bug was announced to the public on 2014-09-24, when Bash updates with the fix were ready for distribution.<ref name="seclist-q3-666">{{cite mailing list|url=http://seclists.org/oss-sec/2014/q3/666|mailing-list=oss-sec |title=Re: CVE-2014-6271: remote code execution through bash|author=Florian Weimer|date=24 September 2014|access-date=1 November 2014}}</ref>
Line 27:
==Background==
The Shellshock bug affects [[Bash (Unix shell)|Bash]], a program that various [[Unix]]-based systems use to execute command lines and command scripts. It is often installed as the system's default [[command-line interface]]. Analysis of the [[source code]] history of Bash shows the bug was introduced on 5 August 1989, and released in Bash version 1.03 on 1 September 1989.<ref name="BASH105_CHANGELOG">{{cite web |last=Fox |first=Brian |title=Bash 1.05 ChangeLog |url=http://www.oldlinux.org/Linux.old/bin/old/bash-1.05/ChangeLog |date=21 March 1990 |access-date=14 October 2014 |archive-date=6 December 2023 |archive-url=https://web.archive.org/web/20231206061143/http://www.oldlinux.org/Linux.old/bin/old/bash-1.05/ChangeLog |url-status=dead }}</ref><ref name="BASHBUG-20141010-SC">{{cite web |last=Chazelas |first=Stéphane |work=Stéphane Chazelas and Chet Ramey confirm the vulnerability introduction date on Bash official communication channel |title=when was shellshock introduced |url=http://thread.gmane.org/gmane.comp.shells.bash.bugs/22418 |date=10 October 2014 |access-date=14 October 2014 |archive-url=https://web.archive.org/web/20161220033324/http://thread.gmane.org/gmane.comp.shells.bash.bugs/22418 |archive-date=20 December 2016 |url-status=dead }}</ref><ref name="Stack Exchange Thread">{{cite web |last=Chazelas |first=Stéphane |url=https://unix.stackexchange.com/questions/157381/when-was-the-shellshock-cve-2014-6271-7169-bug-introduced-and-what-is-the-pat/157495#157495 |title=When was the shellshock (CVE-2014-6271/7169) bug introduced, and what is the patch that fully fixes it? |date=25 September 2014}}</ref>
Shellshock is an [[arbitrary code execution]] vulnerability that offers a way for users of a system to execute commands that should be unavailable to them. This happens through Bash's "function export" feature, whereby one Bash [[process (computing)|process]] can share command scripts with other Bash processes that it executes.<ref>{{cite web|url=https://www.gnu.org/software/bash/manual/bash.html#Shell-Functions|title= Bash Reference Manual: Shell Functions |access-date= 2 October 2014}}</ref> This feature is implemented by encoding the scripts in a table that is shared between the processes, known as the [[environment variable]] list. Each new Bash process scans this table for encoded scripts, assembles each one into a command that defines that script in the new process, and executes that command.<ref name="exported-function">{{cite web|url= http://git.savannah.gnu.org/cgit/bash.git/tree/variables.c?id=ac50fbac377e32b98d2de396f016ea81e8ee9961#n315 |title=Bash 4.3 source code, file variables.c, lines 315-388 |access-date= 2 October 2014}}</ref> The new process assumes that the scripts found in the list come from another Bash process, but it cannot verify this, nor can it verify that the command that it has built is a properly formed script definition. Therefore, an attacker can execute arbitrary commands on the system or exploit other bugs that may exist in Bash's command interpreter, if the attacker has a way to manipulate the environment variable list and then cause Bash to run. At the time the bug was discovered, Bash was installed on [[macOS]] and many [[Linux]] operating systems as the main command interpreter, so that any program that used the <code>system</code> function to run any other program would use Bash to do so.
Line 36:
Within an hour of the announcement of the Bash vulnerability, there were reports of machines being compromised by the bug. By 25 September 2014, [[botnet]]s based on computers compromised with exploits based on the bug were being used by attackers for [[Denial-of-service attack#Distributed attack|distributed denial-of-service]] (DDoS) attacks and [[vulnerability scanner|vulnerability scanning]].<ref name="Wired" /><ref name="IT-20140926-JS" /><ref name="bbconShellshock">{{cite web |author=Various |title=Web attacks build on Shellshock bug |url=https://www.bbc.com/news/technology-29375636 |date=26 September 2014 |work=[[BBC]] |access-date=26 September 2014 }}</ref> [[Kaspersky Labs]] reported that machines compromised in an attack, dubbed "Thanks-Rob", were conducting DDoS attacks against three targets, which they did not identify.<ref name="Wired">{{cite magazine|last1=Greenberg|first1=Andy|title=Hackers Are Already Using the Shellshock Bug to Launch Botnet Attacks|url=https://www.wired.com/2014/09/hackers-already-using-shellshock-bug-create-botnets-ddos-attacks/|magazine=Wired|access-date=28 September 2014|date=25 September 2014}}</ref> On 26 September 2014, a Shellshock-related botnet dubbed "wopbot" was reported, which was being used for a DDoS attack against [[Akamai Technologies]] and to scan the [[United States Department of Defense]].<ref name="IT-20140926-JS">{{cite news |last=Saarinen |first=Juha |title=First Shellshock botnet attacks Akamai, US DoD networks |url=http://www.itnews.com.au/News/396197,first-shellshock-botnet-attacks-akamai-us-dod-networks.aspx |date=26 September 2014 |work=iTnews |access-date=26 September 2014 }}</ref>
On 26 September, the security firm [[Incapsula]] noted 17,400 attacks on more than 1,800 web domains, originating from 400 unique IP addresses, in the previous 24 hours; 55% of the attacks were coming from China and the United States.<ref name="NYT-20140926-NP">{{cite news |last=Perlroth |first=Nicole |title=Companies Rush to Fix Shellshock Software Bug as Hackers Launch Thousands of Attacks |url=http://bits.blogs.nytimes.com/2014/09/26/companies-rush-to-fix-shellshock-software-bug-as-hackers-launch-thousands-of-attacks/ |date=26 September 2014 |work=[[New York Times]] |access-date=29 September 2014 }}</ref> By 30 September, the website performance firm [[CloudFlare]] said it was tracking approximately 1.5 million attacks and probes per day related to the bug.<ref name="businessweek">{{cite web|last1=Strohm|first1=Chris|last2=Robertson|first2=Jordan|title=Shellshock Draws Hacker Attacks, Sparks Race to Patch Bug|url=http://www.businessweek.com/news/2014-09-30/shellshock-draws-hacker-attacks-sparks-race-to-patch-bug|archive-url=https://archive.today/20141001033848/http://www.businessweek.com/news/2014-09-30/shellshock-draws-hacker-attacks-sparks-race-to-patch-bug|url-status=dead|archive-date=1 October 2014|publisher=Businessweek|access-date=1 October 2014|date=30 September 2014 }}</ref>
On 6 October, it was widely reported that [[Yahoo!]] servers had been compromised in an attack related to the Shellshock issue.<ref>{{cite news |last=Boren |first=Zachary |title=Shellshock: Romanian hackers are accessing Yahoo servers, claims security expert |url=https://www.independent.co.uk/life-style/gadgets-and-tech/news/shellshock-romanian-hackers-are-accessing-yahoo-servers-claims-security-expert-9777753.html |date=6 October 2014 |work=Independent |access-date=7 October 2014 }}</ref><ref>{{cite web | url=http://www.futuresouth.us/wordpress/?p=5 | title=Yahoo! Shellshocked Like Ninja Turtles! | access-date=7 October 2014 | url-status=dead | archive-url=https://web.archive.org/web/20141009075833/http://www.futuresouth.us/wordpress/?p=5 | archive-date=9 October 2014 | df=dmy-all }}</ref>
Line 58:
The maintainer of Bash was warned about the first discovery of the bug on 2014-09-12; a fix followed soon.<ref name="NYT-20140925-NP" /> A few companies and distributors were informed before the matter was publicly disclosed on 2014-09-24 with CVE identifier {{CVE|2014-6271}}.<ref name="seclist-q3-650" /><ref name="seclist-q3-666" /> However, after the release of the patch there were subsequent reports of different, yet related vulnerabilities.<ref name="wheeler-summary">{{cite web | url=http://www.dwheeler.com/essays/shellshock.html | title=Shellshock | date=13 February 2015 | access-date=17 September 2016}}</ref>
On 26 September 2014, two open-source contributors, David A. Wheeler and Norihiro Tanaka, noted that there were additional issues, even after patching systems using the most recently available patches. In an email addressed to the oss-sec and bash-bug mailing lists, Wheeler wrote: "This patch just continues the [[Whac-a-Mole|'whack-a-mole']] {{Sic}} job of fixing parsing errors that began with the first patch. Bash's parser is certain [to] have many many many other vulnerabilities".<ref name="BASH Whack-a-mole">{{cite web |last=Gallagher |first=Sean |title=Still more vulnerabilities in bash? Shellshock becomes whack-a-mole |url=https://arstechnica.com/security/2014/09/still-more-vulnerabilities-in-bash-shellshock-becomes-whack-a-mole/|date=26 September 2014 |publisher=[[Arstechnica]] |access-date=26 September 2014}}</ref>
On 27 September 2014, [[Michał Zalewski]] from [[Google Inc.]] announced his discovery of other Bash vulnerabilities,<ref name="ITN-20140929">{{cite web |last=Saarinen |first=Juha |title=Further flaws render Shellshock patch ineffective |url=http://www.itnews.com.au/News/396256,further-flaws-render-shellshock-patch-ineffective.aspx |date=29 September 2014 |work=iTnews |access-date=29 September 2014 }}</ref> one based upon the fact that Bash is typically compiled without [[address space layout randomization]].<ref name="HH-20140928">{{cite web |author=Staff |title=Shellshock, Part 3: Three more security problems in Bash (in german) |url=http://www.heise.de/security/meldung/ShellShock-Teil-3-Noch-drei-Sicherheitsprobleme-bei-der-Bash-2404788.html |date=28 September 2014 |work=[[Heise Online]] |access-date=28 September 2014 }}</ref> On 1 October, Zalewski released details of the final bugs and confirmed that a patch by Florian Weimer from [[Red Hat]] posted on 25 September does indeed prevent them. He has done that using a [[fuzzing]] technique with the aid of software utility known as ''[[american fuzzy lop (fuzzer)|american fuzzy lop]]''.<ref name="lcamtuf-oct-1">{{cite web | url=http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html | title=Bash bug: the other two RCEs, or how we chipped away at the original fix (CVE-2014-6277 and '78) | work=lcamtuf blog | date=1 October 2014 | access-date=8 October 2014}}</ref>
Line 107:
===CVE-2014-7186===
Florian Weimer and Todd Sabin found this bug ({{CVE|2014-7186}}),<ref name="zdnet-betterbash">{{cite web|last1=Vaughan-Nichols|first1=Steven|title=Shellshock: Better 'bash' patches now available|url=
An example of the vulnerability, which leverages the use of multiple "<<EOF" declarations (nested [[Here document|"here documents"]]):
Line 192:
[[Category:Internet security]]
[[Category:Software bugs]]
[[Category:Computer security exploits]]
| |||