 | ||
Shellshock, also known as Bashdoor, is a family of security bugs in the widely used Unix Bash shell, the first of which was disclosed on 24 September 2014. Many Internet-facing services, such as some web server deployments, use Bash to process certain requests, allowing an attacker to cause vulnerable versions of Bash to execute arbitrary commands. This can allow an attacker to gain unauthorized access to a computer system.
Contents
- Background
- Reports of attacks
- Specific exploitation vectors
- Overview
- Initial report CVE 2014 6271
- CVE 2014 6277
- CVE 2014 6278
- CVE 2014 7169
- CVE 2014 7186
- CVE 2014 7187
- Patches
- References
Stéphane Chazelas contacted Bash's maintainer, Chet Ramey, on 12 September 2014 telling Ramey about his discovery of the original bug, which he called "Bashdoor". Working together with security experts, he soon had a patch as well. The bug was assigned the CVE identifier CVE-2014-6271. It was announced to the public on 24 September 2014 when Bash updates with the fix were ready for distribution.
The first bug causes Bash to unintentionally execute commands when the commands are concatenated to the end of function definitions stored in the values of environment variables. Within days of the publication of this, intense scrutiny of the underlying design flaws discovered a variety of related vulnerabilities, (CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187); which Ramey addressed with a series of further patches.
Attackers exploited Shellshock within hours of the initial disclosure by creating botnets of compromised computers to perform distributed denial-of-service attacks and vulnerability scanning. Security companies recorded millions of attacks and probes related to the bug in the days following the disclosure.
Shellshock could potentially compromise millions of unpatched servers and other systems. Accordingly, it has been compared to the Heartbleed bug in its severity.
Background
The Shellshock bug affects Bash, a program that various Unix-based systems use to execute command lines and command scripts. It is often installed as the system's default command-line interface. Analysis of the source code history of Bash shows the bugs had existed since Bash version 1.03 released in September 1989.
Shellshock is a privilege escalation vulnerability which offers a way for users of a system to execute commands that should be unavailable to them. This happens through the "function export" feature, whereby command scripts created in one running instance of Bash can be shared with subordinate instances. This feature is implemented by encoding the scripts within a table that is shared between the instances, known as the environment variable list. Each new instance of Bash scans this table for encoded scripts, assembles each one into a command that defines that script in the new instance, and executes that command. The new instance assumes that the scripts found in the list come from another instance, but it cannot verify this, nor can it verify that the command that it has built is a properly formed script definition. Therefore, an attacker can execute arbitrary commands on the system or exploit other bugs that may exist in Bash's command interpreter, if the attacker has a way to manipulate the environment variable list and then cause Bash to run.
The presence of the bug was announced to the public on 24 September 2014, when Bash updates with the fix were ready for distribution, though it took some time for computers to be updated to close the potential security issue.
Reports of attacks
Within an hour of the announcement of the Bash vulnerability, there were reports of machines being compromised by the bug. By 25 September 2014, botnets based on computers compromised with exploits based on the bug were being used by attackers for distributed denial-of-service (DDoS) attacks and vulnerability scanning. Kaspersky Labs reported that machines compromised in an attack, dubbed "Thanks-Rob", were conducting DDoS attacks against three targets, which they did not identify. On 26 September 2014, a Shellshock-related botnet dubbed "wopbot" was reported, which was being used for a DDoS attack against Akamai Technologies and to scan the United States Department of Defense.
On 26 September, the security firm Incapsula noted 17,400 attacks on more than 1,800 web domains, originating from 400 unique IP addresses, in the previous 24 hours; 55% of the attacks were coming from China and the United States. By 30 September, the website performance firm CloudFlare said it was tracking approximately 1.5 million attacks and probes per day related to the bug.
On 6 October, it was widely reported that Yahoo! servers had been compromised in an attack related to the Shellshock issue. Yet the next day, it was denied that it had been Shellshock that specifically had allowed these attacks.
Specific exploitation vectors
Overview
The maintainer of Bash was warned about the first discovery of the bug on 12 September 2014; a fix followed soon. A few companies and distributors were informed before the matter was publicly disclosed on 24 September 2014 with CVE identifier CVE-2014-6271. However, after the release of the patch there were subsequent reports of different, yet related vulnerabilities.
On 26 September 2014, two open-source contributors, David A. Wheeler and Norihiro Tanaka, noted that there were additional issues, even after patching systems using the most recently available patches. In an email addressed to the oss-sec list and the bash bug list, Wheeler wrote: "This patch just continues the 'whack-a-mole' job of fixing parsing errors that began with the first patch. Bash's parser is certain [to] have many many many other vulnerabilities". However, this rather was some general reasoning without actually presenting exploitation examples and implied restricting Bash functionality with the effect that some Bash scripts won't work any more, even if not intended to harm other users.
On 27 September 2014, Michał Zalewski from Google Inc. announced his discovery of other Bash vulnerabilities, one based upon the fact that Bash is typically compiled without address space layout randomization. On 1 October, Zalewski released details of the final bugs and confirmed that a patch by Florian Weimer from Red Hat posted on 25 September does indeed prevent them. He has done that using a fuzzing technique with the aid of software utility known as american fuzzy lop.
Initial report (CVE-2014-6271)
This original form of the vulnerability involves a specially crafted environment variable containing an exported function definition, followed by arbitrary commands. Bash incorrectly executes the trailing commands when it imports the function. The vulnerability can be tested with the following command:
In systems affected by the vulnerability, the above commands will display the word "vulnerable" as a result of Bash executing the command "echo vulnerable", which was embedded into the specially crafted environment variable named "x".
CVE-2014-6277
Discovered by Michał Zalewski. this vulnerability relates to the parsing of function definitions in environment variables by Bash, and can cause a segfault.
CVE-2014-6278
Also discovered by Michał Zalewski. this relates to the parsing of function definitions in environment variables by Bash.
CVE-2014-7169
On the same day the original vulnerability was published, Tavis Ormandy discovered this related bug which is demonstrated in the following code:
On a vulnerable system this would execute the command "date" unintentionally.
Here is an example of a system that has a patch for CVE-2014-6271 but not CVE-2014-7169:
The system displays syntax errors, notifying the user that CVE-2014-6271 has been prevented, but still writes a file named 'echo', into the working directory, containing the result of the 'date' call.
A system patched for both CVE-2014-6271 and CVE-2014-7169 will simply echo the word "date" and the file "echo" will not be created, as shown below:
CVE-2014-7186
Florian Weimer and Todd Sabin found this bug, which relates to an out-of-bounds memory access error in the Bash parser code.
An example of the vulnerability, which leverages the use of multiple "<<EOF" declarations:
A vulnerable system will echo the text "CVE-2014-7186 vulnerable, redir_stack".
CVE-2014-7187
Also found by Florian Weimer, this is an off-by-one error in the Bash parser code, allowing out-of-bounds memory access.
An example of the vulnerability, which leverages the use of multiple "done" declarations:
A vulnerable system will echo the text "CVE-2014-7187 vulnerable, word_lineno". This test requires a shell that supports brace expansion.
Patches
Until 24 September 2014, Bash maintainer Chet Ramey provided a patch version bash43-025 of Bash 4.3 addressing CVE-2014-6271, which was already packaged by distribution maintainers. On 24 September, bash43-026 followed, addressing CVE-2014-7169. Then CVE-2014-7186 was discovered. Florian Weimer from Red Hat posted some patch code for this "unofficially" on 25 September, which Ramey incorporated into Bash as bash43-027.—These patches provided code only, helpful only for those who know how to compile ("rebuild") a new Bash binary executable file from the patch file and remaining source code files.
The next day, Red Hat officially presented according updates for Red Hat Enterprise Linux, after another day for Fedora 21. Canonical Ltd. presented updates for its Ubuntu Long Term Support versions on Saturday, 27 September; on Sunday, there were updates for SUSE Linux Enterprise. The following Monday and Tuesday at the end of the month, Apple OS X updates appeared.
On 1 October 2014, Michał Zalewski from Google Inc. finally stated that Weimer's code and bash43-027 had fixed not only the first three bugs but even the remaining three that were published after bash43-027, including his own two discoveries. This means that after the earlier distribution updates, no other updates have been required to cover all the six issues.
All of them have also been covered for the IBM Hardware Management Console.