Techsurvivors

Welcome to Techsurvivors => Tech => Topic started by: Paddy on September 24, 2014, 09:40:31 PM

Title: Bash bug
Post by: Paddy on September 24, 2014, 09:40:31 PM
Great...just what we need. rolleyes.gif

http://arstechnica.com/security/2014/09/bu...-it/?comments=1

So far, nothing from Apple and I ran the command to test my system and as expected, it's vulnerable. However, that's assuming someone can get into my system, and that part of the equation is not fully explained in any of the articles I've read so far.
Title: Bash bug
Post by: kimmer on September 24, 2014, 10:25:06 PM
QUOTE(Paddy @ Sep 24 2014, 07:40 PM) <{POST_SNAPBACK}>
So far, nothing from Apple and I ran the command to test my system and as expected, it's vulnerable.

Same here. Hope Apple isn't too busy fixing iOS 8.0.1 to fix this. wink.gif
Title: Bash bug
Post by: Jack W on September 25, 2014, 07:56:03 AM
What's a Bash bug?

And what OS X versions might be vulnerable?

And do I need to worry?

Inquiring minds want to know.

I'm still on 10.6.8, and VERY happy with it.

Jack
Title: Bash bug
Post by: Xairbusdriver on September 25, 2014, 09:11:48 AM
I'm just about knowledgeable to get into trouble using Terminal. Like most Mac apps, Terminal has a command-, Preferences command. In the "Startup" tab, "Shells open with:" accepts several different choices, this archived <Support Document> lists the ones I still see in Mavericks. That's all I know about this 'technology! blush-anim-cl.gif Running the script while only temporarily changing the shell still produces the "vulnerable" text. I assume because the command actually forces it to run in bash.

I permanently changed the Terminal Shell choices six times (from bash to each of the five choices below), Quit Terminal, restarted Terminal, edited the command to the reflect the new shell (saved/edited in TextEdit).
Result of tests: dntknw.gif

Unfortunately, there seem to be some things (specifically CUPS drivers) that only use bash. I can only assume that changing Terminal, via its Prefs, would affect those things. OTOH, it may make no difference. The problems is that bash has a security hole that needs patching. I suspect Apple may not make this a huge priority as so few Mac users even know that Terminal is available. I hope I'm wrong! rolleyes.gif

A bit more simple explanation and possible locations where it could exist (routers/printers/web-servers). <‘shell shock’ @ MacIssues.com>
Title: Bash bug
Post by: jchuzi on September 26, 2014, 06:08:52 AM
How to unofficially fix the ‘Shell Shock’ bash vulnerability in OS X
Title: Bash bug
Post by: Xairbusdriver on September 26, 2014, 08:25:15 AM
If Apple is as fast with this as they were with the iPhone fix, there should be an update for the OS today. Of course, that still leaves all the other hardware not under Apple's control. rolleyes.gif
Title: Bash bug
Post by: jchuzi on September 26, 2014, 08:55:47 AM
Considering that all versions of OS X are affected, will Apple issue a patch for 10.6 and earlier? That's an important question.
Title: Bash bug
Post by: Xairbusdriver on September 26, 2014, 09:29:20 AM
I believe the problem, for OS X, anyway, is simply a patch to bash .exe file in /bin. That * should be relatively simple! I can only *assume that the fix will remove the problems with hardware directly connected to any machine calling bash.

This remark (below) from Mr. Cook is, hopefully, just spin trying to offer calm to the wide-spread news coverage. OTOH, I think it could be better worded; without mentioning what "advanced UNIX services" are, many owners of multiple machines may not realize they are possibly "advanced users". rolleyes.gif

QUOTE("Tim Cook on iMore.com via MacIssues")
With OS X, systems are safe by default and not exposed to remote exploits of bash unless users configure advanced UNIX services. We are working to quickly provide a software update for our advanced UNIX users.

* Two most over-used words in any language! laughhard.gif

* A seriously dangerous and often mistaken attitude.
Title: Bash bug
Post by: jchuzi on September 26, 2014, 11:16:32 AM
Here's another take: Safe from Shellshock: How to protect your home computer from the Bash shell bug
Title: Bash bug
Post by: beacher on September 26, 2014, 11:39:05 AM
What I took away from the article was that as long as you're behind the firewall, you're safe. . . Am I wrong? Thinking.gif
Title: Bash bug
Post by: Xairbusdriver on September 26, 2014, 12:26:57 PM
QUOTE
as long as you're behind the firewall, you're safe
Certainly the recommended standard setup. But there are numerous things using the Internet that also use bash; your cable router may, even the WiFi router (even Apple's), a networked printer, etc. I've read that CUPS drivers use it, be careful of any offers to update those. wink.gif The most security we have, right now, is that most malware still needs approval from the administrator to install/run. The real problem with this is on the servers you access via the net and there's really nothing you can do about those other than to avoid un-trusted sites. You might want to turn off Remote Login, Management and Apple Events in your Sharing Prefs, however. Especially if that 'remote' sharing is done on an external connection. This is all my opinion, of course, which won't buy you a cup of java at Fivebucks, even if you include a couple of dollars! laughhard.gif I think Apple will have a download patch by tomorrow, if not by tonight. The bad PR is so wide-spread, even my mother-in-law probably has heard about it! rolleyes.gif

While searching for known 10.9.5 problem reports, I cam across a thread on the Apple Forums that has some well detailed, if opinionated, recommendations on using the Mac safely. Interesting read, don't agree completely but worth the read. There's a bit that talks about the Firewall that is interesting, also.
<Linc Davis post at or very near the bottom of the page>
Title: Bash bug
Post by: tacit on September 26, 2014, 04:29:40 PM
QUOTE(Paddy @ Sep 25 2014, 02:40 AM) <{POST_SNAPBACK}>
So far, nothing from Apple and I ran the command to test my system and as expected, it's vulnerable. However, that's assuming someone can get into my system, and that part of the equation is not fully explained in any of the articles I've read so far.


By default, unless you're doing something unusual on your Mac, people elsewhere can't exploit this vulnerability.

If you are doing something unusual that specifically allows shell access to other people on the Internet, then it is possible for someone to exploit this remotely. In order to do that, you would have to be running some kind of server on your Mac that allows shell access.

You could, for example, run a Web server on your Mac and have it allow CGI scripts to access the shell, and then you might be vulnerable to attack. If that all sounds like gibberish to you, you're probably not doing it. smile.gif
Title: Bash bug
Post by: Paddy on September 26, 2014, 05:27:16 PM
QUOTE(tacit @ Sep 26 2014, 05:29 PM) <{POST_SNAPBACK}>
QUOTE(Paddy @ Sep 25 2014, 02:40 AM) <{POST_SNAPBACK}>
So far, nothing from Apple and I ran the command to test my system and as expected, it's vulnerable. However, that's assuming someone can get into my system, and that part of the equation is not fully explained in any of the articles I've read so far.


By default, unless you're doing something unusual on your Mac, people elsewhere can't exploit this vulnerability.

If you are doing something unusual that specifically allows shell access to other people on the Internet, then it is possible for someone to exploit this remotely. In order to do that, you would have to be running some kind of server on your Mac that allows shell access.

You could, for example, run a Web server on your Mac and have it allow CGI scripts to access the shell, and then you might be vulnerable to attack. If that all sounds like gibberish to you, you're probably not doing it. smile.gif


It's not gibberish and I'm not doing it. wink.gif

I was pretty sure that regular users were not vulnerable, but with all the hand-flapping and BIG SCARY HEADLINES (the press just loves those!) combined with the inadequate explanations of how or if this actually affected the average computer user, I wasn't about to go out on a limb and say "don't panic."

Now I will.

Don't panic. biggrin.gif

Title: Bash bug
Post by: Xairbusdriver on September 26, 2014, 06:01:04 PM
I don't think any of the sites we've linked to have said anyone needs to panic, in fact, just the opposite has been said in most of them, even the Windows sites. dntknw.gif The fact remains that this is a huge problem, even if you are not personally affected. I suspect that most details are not mentioned specifically because not many consumers would understand them. Another reason is to gain click throughout. wink.gif  There are probably few hackers who haven't figured out how to use this bug except for the neophytes, and there is no point in giving them any more details! Lastly, the more "concern" that can be generated, the sooner all the installations of bash will be updated.

Next. rolleyes.gif
Title: Bash bug
Post by: jchuzi on September 26, 2014, 06:41:39 PM
As the saying goes:

If you can remain calm while those around you are in a panic, you probably don't understand the situation.
Title: Bash bug
Post by: Xairbusdriver on September 26, 2014, 07:02:00 PM
QUOTE
If you can remain calm while those around you are in a panic, you probably don't understand the situation.
That's why they trained us to whistle while we walked to the back with our parachutes on... laughhard.gif
Title: Bash bug
Post by: Paddy on September 26, 2014, 08:28:25 PM
To clarify, since clarification seems necessary...I'm not suggesting that Apple et al not patch this bug, not at all. Nor am I suggesting that they should take their sweet time doing it. Just that there seemed to be a lot the-sky-is-falling-this-is-worse-than-Heartbleed-OMG sort of headlines out there and the truth is, as Tacit states, that for most of us, it's not going to be an issue on our own computers. I'm not for a moment saying that it couldn't be a big mess if some major websites, many of which run on Linux and use Apache, were compromised by clever hackers, and there are many, many ways that hackers could create havoc on the internet with this thing if it isn't patched. That, I think is probably the biggest threat, and it is definitely something that needs to be attended to ASAP. I've checked my own sites on Hostgator, and it would appear that Hostgator has patched their servers.

Meanwhile, we wait.
Title: Bash bug
Post by: Xairbusdriver on September 29, 2014, 05:51:18 PM
I suppose it's finally time for mr to get 10.9.5! Apple has issued a minimal fix for the "Shell Shock/bash Bug" for Mavericks (and also 10.7 & 10.8) but to get the fix, one must also have the last update for each OS: 5 If you have that, you should find the bash bug fix in the MAS.
Title: Bash bug
Post by: Paddy on September 30, 2014, 08:28:39 AM
BTW - at the moment (at least) it's a manual update, not available via Software Update. You can download it here:

http://support.apple.com/kb/DL1769?viewloc...mp;locale=en_US

Lots of discussion of the patch in the comments section at Ars Technica's article on the update: http://arstechnica.com/apple/2014/09/apple...0-7/?comments=1

It would appear from the comments that Apple went above and beyond with the patch (which is good) although there is some quibbling about details.

I'm assuming that it will appear via Software Update shortly (though it's been a rather long 15+ hours since it first appeared, so not sure what the delay is).
Title: Bash bug
Post by: Xairbusdriver on September 30, 2014, 10:24:50 AM
I assumed that it didn't show in SU since I had already downloaded it from the link you posted. Doesn't really make sense, however, since I did not install it until I updated Mavericks. One report I read before posting yesterday said it was at SU but I had not updated to 10.9.5, again, I assumed it was because I didn't have the minimum OS. One "assumption" is bad enough! When I make two, the same day... eek2.gif

BTW, the patch is also available for:As most are aware, Apple has stopped support (except Security updates) for Snow Leopard (10.6). However, if you'll download Xcode 3.2, there are files that you can use to compile a version with the patch.
Title: Bash bug
Post by: jchuzi on September 30, 2014, 12:27:51 PM
For those who need a link to the instructions for manually installing the fix, read How to unofficially fix the ‘Shell Shock’ bash vulnerability in OS X. I'm merely posting this; I haven't installed it yet nor am I sure that I will.
Title: Bash bug
Post by: krissel on October 02, 2014, 12:28:42 AM
For those who are still running earlier OSXs, here is a patch for 10.4 and up on Intel and PPC.

http://tenfourfox.blogspot.com/2014/09/bas...me-updated.html
Title: Bash bug
Post by: gunug on October 02, 2014, 01:08:21 PM
For better or worse I ran the non-automatic fix on my office MacPro (on the 10.9.5 partition), everything seems to be fine and it passes the BASH test.  I will check out the fix on the 10.6.8 partition and my carry around Macbook Pro later.  I wondered what all of this might have to do with our older cloning procedure, which boots up a Novell Linux with a BASH shell; all I got from the pertinent guy in networking is a laugh.  The older one is
only used to put Windows XP onto computers to go to sale, we aren't paying to upgrade computers to sell for pennies on the dollar!
Title: Bash bug
Post by: jchuzi on October 03, 2014, 06:08:27 AM
How to create a ‘Shell Shock’ Bash Update installer for OS X 10.6
Title: Bash bug
Post by: jchuzi on October 06, 2014, 09:43:33 AM
Two scenarios that can make OS X vulnerable to the Shellshock Bash bug