From owner-freebsd-security@FreeBSD.ORG Thu Sep 25 13:28:20 2014 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id A2A512AC for ; Thu, 25 Sep 2014 13:28:20 +0000 (UTC) Received: from mta1-filtered.netlife.no (mail.netlife.no [62.92.26.226]) by mx1.freebsd.org (Postfix) with ESMTP id 5E96ECFC for ; Thu, 25 Sep 2014 13:28:19 +0000 (UTC) Received: from amavis.netlife.no (unknown [10.115.1.11]) by mta1-filtered.netlife.no (Postfix) with ESMTP id C8AB5A13D8C for ; Thu, 25 Sep 2014 15:21:04 +0200 (CEST) X-Virus-Scanned: amavisd-new at netlife.no Received: from mta1-submission.netlife.no ([62.92.26.226]) by amavis.netlife.no (amavis.netlife.no [10.115.1.11]) (amavisd-new, port 10026) with ESMTP id L5zxezyAcSCe for ; Thu, 25 Sep 2014 13:21:04 +0000 (UTC) Received: from [10.0.0.41] (unknown [195.1.220.218]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) (Authenticated sender: erik@tefre.com) by mta1-submission.netlife.no (Postfix) with ESMTPSA id 990A4A13D83 for ; Thu, 25 Sep 2014 15:21:04 +0200 (CEST) Message-ID: <542416C0.2040203@tefre.com> Date: Thu, 25 Sep 2014 15:21:04 +0200 From: Erik Stian Tefre User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.1.1 MIME-Version: 1.0 To: freebsd-security@freebsd.org Subject: Bash ShellShock bug(s) Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Mailman-Approved-At: Thu, 25 Sep 2014 13:36:03 +0000 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 25 Sep 2014 13:28:20 -0000 I hereby declare the bash ShellShock bug(s) worthy of mention. Yes, bash is just a port in FreeBSD, but: Hundreds of other ports (including network accessible ports) seem to depend on shells/bash. (Figuring out if they use it in a vulnerable way or not is left as an exercise for the reader.) Custom/third party apps might also be using bash. Some users perfer to chsh -s bash. [> Insert your favourite reason to patch here <] References to the ShellShock bug(s): http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271 ^ Seems to be patched in ports, bash >= 4.3.25. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169 ^ Patch does not yet exist? Here's a little copy-and-paste exercise for verifying CVE-2014-6271 vulnerability: env var='() { ignore this;}; echo vulnerable' bash -c /usr/bin/true -- Erik