Shell shocked - the Bash bug

Summary

This blog post, "Shell shocked - the Bash bug", is a blueAPACHE article from 2014 covering security. A critical security flaw known as ‘Shell Shock’ has recently been found in Bash that is worrying a lot of people, and rightly so. The US National Vulnerability Database rate this new flaw as a Level 10, and CERT Australia has noted plenty of online chatter around exploiting the bug. It is written for readers evaluating Exposure Management, emPOWER Security. The underlying security practice it describes, reducing attack surface and improving detection and response, is not tied to a specific product version and remains relevant to any organisation managing cyber risk today.

Key facts

Article

A critical security flaw known as ‘Shell Shock’ has recently been found in Bash that is worrying a lot of people, and rightly so. The US National Vulnerability Database rate this new flaw as a Level 10, and CERT Australia has noted plenty of online chatter around exploiting the bug.

What is Bash?

Bash (Bourne Again Shell) is a pervasive command line utility used in many Unix-based operating systems including Linux and OS X. Bash is not a new command line tool – it was first released in 1989 and is now distributed open source software under the GNU project. Its design can be directly traced back to the origins of Unix in the late 1960s.

What is Shell Shock?

Shell Shock was first discovered by Edinburgh-based programmer Stephane Chazelas weeks ago. The bug, present in all versions of Bash dating back at least to 1994, relates to the handling of configuration information. A maliciously formatted configuration string can cause Bash to do literally anything the user has permission to do. As it can be easily exploited remotely and can give an attacker full control over a system, this vulnerability is known as a Remote Root exploit – the worst kind.

Who is affected?

Anyone running Bash is at risk. This includes Linux, Unix and Mac OS users (including Mac desktop and lap top users). Most Mac desktop systems do not have many network-accessible server programs running on them by default, which limits the ways the bug could be exploited. However, email attachments represent one possibility the bug can be leveraged, as do malicious Wi-Fi hot spots. Mac laptop users connecting to untrusted hot spots risk an attacker exploiting the flaw and securing full access to their computer. Windows-based desktops and laptops do not include Bash by default, so only those that have deliberately installed Bash need be concerned.

How to mitigate the risk?

Most operating system vendors have already released updates that completely or at least partially mitigate the risk of being exploited. CERT Australia recommend that all system administrators and consumers ensure their software updates are applied as soon as they become available.

References

CERT Australia has issued an Advisory about the vulnerability. The US National Vulnerability Database rates this as severity 10. To better understand your security risks, contact the blueAPACHE Account Management Team.

Related

• Exposure Management
• emPOWER Security (pillar hub)
• emPOWER Security
• emPOWER Core Network & DC Interconnect
• emPOWER Connectivity (pillar hub)

Frequently asked questions

What severity rating did the US National Vulnerability Database give the Shell Shock bug?

The post says the US National Vulnerability Database rated the Shell Shock flaw as a Level 10, its top severity rating.

Who first discovered Shell Shock, and how long before this post was it found?

The post says Shell Shock was first discovered by Edinburgh-based programmer Stephane Chazelas a few weeks before the post was published.

How far back does the Shell Shock vulnerability in Bash date, according to the post?

The post says the bug is present in all versions of Bash dating back at least to 1994, relating to how Bash handles configuration information.

What is Bash, and when was it first released, per the post?

The post describes Bash (Bourne Again Shell) as a pervasive command line utility used in many Unix-based operating systems, including Linux and OS X, first released in 1989 and distributed as open source software under the GNU project, with design origins traceable to Unix in the late 1960s.

Why does the post classify Shell Shock as a 'Remote Root exploit'?

The post says a maliciously formatted configuration string can cause Bash to do literally anything the user has permission to do, and because it can be easily exploited remotely and give an attacker full control over a system, it is classed as a Remote Root exploit, described as the worst kind.

Are Windows users at risk from Shell Shock, according to the post?

Generally not. The post says Windows-based desktops and laptops do not include Bash by default, so only those who have deliberately installed Bash need be concerned.

How could the Shell Shock bug specifically be exploited on Mac desktop or laptop systems, per the post?

The post says most Mac desktops have few network-accessible server programs running by default, limiting exploitation, but email attachments and malicious Wi-Fi hotspots represent ways the bug could be leveraged, with laptop users on untrusted hotspots at risk of an attacker gaining full access to their computer.

What mitigation does CERT Australia recommend for the Shell Shock bug, according to the post?

The post says CERT Australia recommends that all system administrators and consumers ensure their software updates are applied as soon as they become available, since most operating system vendors had already released updates that fully or partly mitigate the risk.

Source

• origin post (2014)

Knowledge Base