ShellShock

[DaPlumber]

ShellShock, more deadly than Heartbleed?

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169

Just in case that you want to verify whether Bash is vulnerable

run this simple command:

env x='() { :;}; echo vulnerable' bash -c "echo test" | grep -v "test"

It looks like FreeNAS-9.2.1.7-RELEASE-x64 IS vulnerable.

Not that my FreeNAS is exposed to the world-wild web, but...

 

[Ericloewe]

Not to worry, 9.2.1.8 is coming up:

http://forums.freenas.org/index.php?threads/its-bashs-turn-to-have-a-security-hole.23698/

Unless of course you suddenly have to patch a bunch of *nix things...

 

[anodos]

Yep, the sky is falling again. Pretty soon iX will update the skiddy shield (put out an update with the patch).

 

[vuarnet]

Can we disable bash without posing any risk to our FreeNAS box? I currently have CIFS, AD integration, and Apple shares enabled... not sure if any of that requires bash :/

My FreeNAS box isn't exposed to the public and doesn't connect to the Internet so I'm not terribly worried, but still...

 

[anodos]

Can we disable bash without posing any risk to our FreeNAS box? I currently have CIFS, AD integration, and Apple shares enabled... not sure if any of that requires bash :/

My FreeNAS box isn't exposed to the public and doesn't connect to the Internet so I'm not terribly worried, but still...

Just wait for the 9.2.1.8 to come out. I'm sure it will be out soon, but it takes some time to do proper testing before releasing software.

By the way, it's not even clear that there is a way to exploit this bug on FreeNAS.

 

[vuarnet]

Just wait for the 9.2.1.8 to come out. I'm sure it will be out soon, but it takes some time to do proper testing before releasing software.

By the way, it's not even clear that there is a way to exploit this bug on FreeNAS.

Thanks for the consolation -- I agree it's not that big of a deal. I didn't even think FreeNAS used bash until this -- I just assumed it used csh like FreeBSD. Learn something new every day :)

 

[anodos]

Thanks for the consolation -- I agree it's not that big of a deal. I didn't even think FreeNAS used bash until this -- I just assumed it used csh like FreeBSD. Learn something new every day :)

I'm not a developer and so I don't know whether bash is used. It could be that bash is installed by default for convenience of users. FreeNAS is designed as an appliance (you can't just choose to install a new shell), so it makes sense to include such things by default. Or it could be that bash is used in some FreeNAS scripts (like the CLI version of warden). I don't know and I'm too lazy to find out. :)

 

[cyberjock]

Locking this thread as we don't need "another bash vulnerability" thread.