hi list,

the following bug (Remote code execution through bash)
http://www.reddit.com/r/netsec/comments/2hbxtc/cve20146271_remote_code_execution_through_bash/

**might** affect you if you use a shell/bash - based fcgi-wrapper like in the following
receipt: http://wiki.nginx.org/Fcgiwrap / http://wiki.nginx.org/FcgiwrapDebianInitScript
(did not tested it); if someone runs a shell-based cgi-wrapper and would like to test the POC from
reddit, i'd be interested in the result :D

curl -v -k -H 'User-Agent: () { :;}; echo aa>/tmp/aa' http://example.com/path/to/file


at least i can confirm this affects bash-based CGIs.
ssh-based gitolite/gitlab et al are affected too.


local self-test:

# Output, wenn vulnerable:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test


# Output, wenn not vulnerable:

$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test



additional references:

Advisory CVE-2014-6271: remote code execution through bash (oss-sec-ml)
http://seclists.org/oss-sec/2014/q3/649

Analysis 1 oss-sec ml
http://seclists.org/oss-sec/2014/q3/650

Analysis 2 / RedHat
https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

Naxsi-WAF Signatures
http://blog.dorvakt.org/2014/09/ruleset-update-possible-remote-code.html



regards & happy patching
(and sorry for this slightly OT-post)


mex