SGI: Security

Now that the word is out about this absolutely massive bash exploit, should any of us folks still running Irix machines on the net be at all concerned?

An article on it.

Only on two cases:

The specific: If you use a bash script for CGI
The general: If you've replaced /bin/sh with bash

I'll add that the exploit-tests I've seen in my logs are using ping to test if it works; ours is in /usr/etc and AIUI that's not in the default path so even if you're vulnerable it wouldn't trigger the scriptkiddies at least.

You're more cooked if you're on a system where /bin/sh == /bin/bash. OS X is such a system. I quickly built a standalone bash for 10.4+ PPC/Intel if you want one of those.

http://tenfourfox.blogspot.com/2014/09/ ... -bash.html

But I think IRIX is very low risk.

Is your body^H^H^H^H mac ready?

https://www.schneier.com/blog/archives/2014/09/nasty_vulnerabi.html
http://mac-how-to.wonderhowto.com/how-to/every-mac-is-vulnerable-shellshock-bash-exploit-heres-patch-os-x-0157606/

Some additional perspective here - http://www.infoworld.com/article/268787 ... thedeepend

good thing i never liked bash

Vulnerability not fully fixed.
https://bugzilla.redhat.com/show_bug.cgi?id=1141597#c23

Why'd they start replacing /bin/sh with BASH anyway? Sun went into depth as to why that was not a good idea (and better to have a static /bin/sh), and it's not like sh added too much bloat to the system.

SAQ wrote: Why'd they start replacing /bin/sh with BASH anyway?

Heathen ! get thee hence, thou Unbeliever !

SAQ wrote: Why'd they start replacing /bin/sh with BASH anyway? Sun went into depth as to why that was not a good idea (and better to have a static /bin/sh), and it's not like sh added too much bloat to the system.

What are you, some sort of graybeard who knows things and stuff?

Second patch seems to pass muster:

http://seclists.org/oss-sec/2014/q3/734

I updated the OS X universal bash already (10.4-10.9, PPC and x86).
http://tenfourfox.blogspot.com/2014/09/ ... dated.html

ClassicHasClass wrote: I updated the OS X universal bash already (10.4-10.9, PPC and x86).
http://tenfourfox.blogspot.com/2014/09/ ... dated.html

Thanks, CHC! I'll load it on some machines today!

fuggeddaboutit....

robespierre wrote:

Code: Select all

$ sudo -s
# chmod -x /bin/bash
# ln -f /bin/ksh /bin/sh

fuggeddaboutit....

On linux this will likely break things badly. Remember that these kids have been thinking that sh = bash since they first licked a beige box.

duck wrote: [...]since they first licked a beige box.

Whaddya' mean? that's not what the floppy drive is for? All these years of my life spent in confusion.

VenomousPinecone wrote: Whaddya' mean? that's not what the floppy drive is for? All these years of my life spent in confusion.

French-kissing floppy drives is a thing I hadn't yet imagined, but alas it is now quite hard to forget.

duck wrote:

robespierre wrote:

Code: Select all

$ sudo -s
# chmod -x /bin/bash
# ln -f /bin/ksh /bin/sh

fuggeddaboutit....

On linux this will likely break things badly. Remember that these kids have been thinking that sh = bash since they first licked a beige box.

i did the same on osx but with zsh. might work for linux, too

foetz wrote:

robespierre wrote:

Code: Select all

# ln -f /bin/ksh /bin/sh

i did the same on osx but with zsh. might work for linux, too

That might work better, and osx probably has less of a dependency on it wrt. system scripts.

duck wrote:

robespierre wrote:

Code: Select all

$ sudo -s
# chmod -x /bin/bash
# ln -f /bin/ksh /bin/sh

fuggeddaboutit....

On linux this will likely break things badly. Remember that these kids have been thinking that sh = bash since they first licked a beige box.

Yeah, duck is right. I'd be cautious about about simply replacing bash with ksh as "sh" on a production machine, especially if it's a multi-user machine. If you can be sure that every script is limited to basic Bourne functions, you'll probably be okay, but ksh and bash are not 100% interchangeable. They are both supersets of sh functionality, but the extra features do not completely overlap each other, and if anything calls a unique function, the results may be quite unexpected.

There is also the problem of scripts which explicitly call /bin/bash, which is usually the "correct" thing to do if you are using superset functionality.

Debian has 'dash' as /bin/sh, but of course /bin/bash is there so that won't save you. I just installed the third bash update in 2 days