codez Posted September 25, 2014 Report Share Posted September 25, 2014 (edited) Ja nu gadījumā kāds vēl nav pamanījis: http://www.theregister.co.uk/2014/09/24/bash_shell_vuln/ Tā ir ievainojamība, ka ļauj bash shell mainīgajos padot skriptu, kurš izpildās. Pielietojums plašs, sakot ar tikla programmām, kuras izmanto bash skriptu un tādā veidā var tikt inficēta jūsu kaste. Ievadiet kādu no šiem konsolē, ja izvada busted, tātad ievainojamība nav salāpīta. env X="() { :;} ; echo busted" /bin/sh -c "echo completed" env X="() { :;} ; echo busted" `which bash` -c "echo completed" Edited September 25, 2014 by codez Quote Link to comment Share on other sites More sharing options...
daGrevis Posted September 25, 2014 Report Share Posted September 25, 2014 Mhm. Šitas ir pat lielāks par Heartbleed. Quote Link to comment Share on other sites More sharing options...
Kasspars Posted September 25, 2014 Report Share Posted September 25, 2014 Ha haaa windowsam pie kājas :D Quote Link to comment Share on other sites More sharing options...
werd Posted September 28, 2014 Report Share Posted September 28, 2014 Lietderīgi būtu pievienot norādes, kā to novērst - https://www.digitalocean.com/community/tutorials/how-to-protect-your-server-against-the-shellshock-bash-vulnerability Quote Link to comment Share on other sites More sharing options...
F3llony Posted September 28, 2014 Report Share Posted September 28, 2014 Ha haaa windowsam pie kājas :D Meh, meanwhile windowsam x10m ievainojamības stāv vaļā mēnešiem un gadiem. Linuksī, on the other hand - > Vuln > yum upgrade > Fixed, all done, Ill be damned! Quote Link to comment Share on other sites More sharing options...
Kasspars Posted September 28, 2014 Report Share Posted September 28, 2014 Šis caurums ekistējis kopš 1992. gada. Tā pat bija ar heartbleed. Neviens nezin cik vēl neatklātu caurumu ir *nix sistēmās. Quote Link to comment Share on other sites More sharing options...
jurchiks Posted September 28, 2014 Report Share Posted September 28, 2014 Es jau teiktu, ka tas ir salauztās "don't fix what's not broken" mentalitātes dēļ - kods strādā, značit uzlabot nevajag, značit neviens nekad to arī nelasa, un ja tur ir bags, tad neviens par to neuzzin līdz brīdim, kad kaut kas šāds uzpeld. Protams, mani uzreiz par to nodirsīs, tas pat nav jājautā. Quote Link to comment Share on other sites More sharing options...
codez Posted September 28, 2014 Author Report Share Posted September 28, 2014 Nav vērts pat uzsākts diskusiju par to, kas ir drošāks: Linux vai Win. Bet šis caurums ir vienkārši WTF un noteikti bija cilvēki, kas jau gadiem to izmantoja un tagad ir nedaudz skumīgi. Quote Link to comment Share on other sites More sharing options...
daGrevis Posted September 29, 2014 Report Share Posted September 29, 2014 > Es jau teiktu, ka tas ir salauztās "don't fix what's not broken" mentalitātes dēļ - kods strādā, značit uzlabot nevajag, značit neviens nekad to arī nelasa, un ja tur ir bags, tad neviens par to neuzzin līdz brīdim, kad kaut kas šāds uzpeld. Šoreiz es tev piekrītu. :) Quote Link to comment Share on other sites More sharing options...
jurchiks Posted September 29, 2014 Report Share Posted September 29, 2014 >Šoreiz es tev piekrītu. :) I'll be damn! Quote Link to comment Share on other sites More sharing options...
F3llony Posted September 29, 2014 Report Share Posted September 29, 2014 Labi, windows ar visu flame, bet problēma ir, ka bashbug ir ne tikai desktopiem un serveriem, bet arī plašam reindžam embedded devaisu Quote Link to comment Share on other sites More sharing options...
Kasspars Posted September 29, 2014 Report Share Posted September 29, 2014 Cik saprotu, tad bashbugu var izmantot tikai, ja aplikācija palaiž komandu ar usera inputu. Tb SQL injekcija tikai ar basham. Ja shells netiek izmantots, tad uztraukumam nav pamata. Tā ir?? Quote Link to comment Share on other sites More sharing options...
spainis Posted September 30, 2014 Report Share Posted September 30, 2014 CGI trololo Quote Link to comment Share on other sites More sharing options...
codez Posted September 30, 2014 Author Report Share Posted September 30, 2014 CGI nieks, pat SSH serveris izmantoja bash un setoja env variabļus. Quote Link to comment Share on other sites More sharing options...
spainis Posted September 30, 2014 Report Share Posted September 30, 2014 I see your ssh and raise you dhcp (https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/) Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.