Bash "shellshock" vulnerability info?

[flaxton]

I'm surprised to not see any posts about this today, but hey here goes.

If you haven't read about it, DROP WHAT YOU ARE DOING and read it now. Seriously!

http://www.theverge.com/2014/9/25/6843669/bash-shellshock-network-worm-could-cause-internet-meltdown

I did update my CentOS 6 servers using:

sudo yum update bash

and verified that most methods did not show the vulnerability. But there is talk that this is *not* a complete patch. So I'm not feeling confident.

Besides the command line, CGI scripts are the big vulnerability. I don't use/need these, but they are apparently turned on *by default* grr. Who uses cgi-bin any more? I'm sure there must be a few, but all our apps use PHP.

So, I'm looking to disable CGI-BIN server-wide from the command-line. No information in the Parallels help system that I could find. I don't want to use the GUI to click away for hours on end when I could write a script to do it...if I know what command to issue!

Any comments appreciated!

 

[flaxton]

Nevermind, I think I found out how to disable cgi-bin in the command line reference. I will test and report back.

 

[flaxton]

Done. OK here is a script I wrote that does work.

#!/bin/bash
#
# Disable CGI (cgi-bin) in response to the bash bug "shellshock"
#
# list domains, filter out non-domains
for sub in `ls /var/www/vhosts/ | egrep -v "(fs|fs-passwd|default|chroot|.skel)"` ;
# step thru the domains and execute command on each
do #echo "subscription: " $sub
/usr/local/psa/bin/subscription -u $sub -cgi false
done

 

[flaxton]

BTW apparently the "site" command could have also been used. But like I said, this script works, I just ran it on multiple servers.

Usual disclaimer - Use at your own risk. If you don't know bash or scripts, this would not be a good idea for you to try. Just use the GUI (and take forever).

 

[IgorG]

You can refer to KB - http://kb.odin.com/en/123006

 

[flaxton]

Thanks IgorG, good info.

A second bash patch is out. CentOS 6 has the update already. To update:

yum update bash

To update just bash on Ubuntu, these are the commands:

apt-get update
apt-get --only-upgrade install bash

I'm still not convinced this is the last word on this. Some are showing even the second patch has an exploit that works against it.

I will stick with CGI turned off, and monitoring my server logs.

I'm also looking for a good mod_security rule to add to my web application firewall.

 

[atomicturtle]

We put mod_security rules out for this in the Atomic feed earlier this week. If you are using ASL or aum this was update would have already been applied automatically, and you shouldn't have to do anything else.