4 ms·

Could anyone provide a simplified explanation for what this is and what it means?

amalcon 12y ago
This is a completely bonkers, Slammer-level hair-on-fire vulnerability. Remember Heartbleed? This is much worse. If you have a computer with an OS other than Windows or Android, your safest bet is to unplug it from the Internet until the bash developers figure this all out.
- grimtrigger 12y ago
  And my servers? Is there anything I can do without taking them offline?
  - amalcon 12y ago
    Well, you could remove bash entirely (say, by replacing it with a link to dash). Doing this will likely break things, however, up to and including rendering the machine unbootable depending on which distribution it is and how the init scripts are written. You could replace bash with e.g. a perl script that strips parenthesis from your environment variables, and then invokes a differently named copy of bash. That might not break anything. Then again, it might.
    - barsonme 12y ago
      > Well, you could remove bash entirely (say, by replacing it with a link to dash) Just did this, except I accidentally removed both bash and dash... it wasn't fun having to compile bash from source with zsh. For whatever reason it absolutely did not want to work. But all back to normal now.
  - wglb 12y ago
    I patched mine with a apt-get update sequence. It fixed the bug (first fix, not yet the second), and I didn't have to take the server down. Everything stayed up.
- deleted 12y ago
  [deleted]
  - mzs 12y ago
    My version of ash seems unaffected. Do you have more info? # env x='() { :;}; echo vulnerable' /bin/sh -c "echo this is a test" this is a test # env x='() { :;}; echo vulnerable' /bin/ash -c "echo this is a test" this is a test
  - amalcon 12y ago
    Huh, I literally just checked all the shells on my android device (with code that worked on my laptop earlier), and it didn't seem vulnerable. Are you talking about a different vulnerability?
  - ryan-c 12y ago
    Android is not vulnerable. The person who posted a screenshot on twitter has bash installed on their phone. It is not in stock Android as far as I can tell, nor is it on my manually rooted Nexus 5. What the rooting tools install I don't know, it might include bash.

This is a completely bonkers, Slammer-level hair-on-fire vulnerability. Remember Heartbleed? This is much worse. If you have a computer with an OS other than Windows or Android, your safest bet is to unplug it from the Internet until the bash developers figure this all out.

grimtrigger 12y ago
And my servers? Is there anything I can do without taking them offline?
- amalcon 12y ago
  Well, you could remove bash entirely (say, by replacing it with a link to dash). Doing this will likely break things, however, up to and including rendering the machine unbootable depending on which distribution it is and how the init scripts are written. You could replace bash with e.g. a perl script that strips parenthesis from your environment variables, and then invokes a differently named copy of bash. That might not break anything. Then again, it might.
  - barsonme 12y ago
    > Well, you could remove bash entirely (say, by replacing it with a link to dash) Just did this, except I accidentally removed both bash and dash... it wasn't fun having to compile bash from source with zsh. For whatever reason it absolutely did not want to work. But all back to normal now.
- wglb 12y ago
  I patched mine with a apt-get update sequence. It fixed the bug (first fix, not yet the second), and I didn't have to take the server down. Everything stayed up.
deleted 12y ago
[deleted]
- mzs 12y ago
  My version of ash seems unaffected. Do you have more info? # env x='() { :;}; echo vulnerable' /bin/sh -c "echo this is a test" this is a test # env x='() { :;}; echo vulnerable' /bin/ash -c "echo this is a test" this is a test
- amalcon 12y ago
  Huh, I literally just checked all the shells on my android device (with code that worked on my laptop earlier), and it didn't seem vulnerable. Are you talking about a different vulnerability?
- ryan-c 12y ago
  Android is not vulnerable. The person who posted a screenshot on twitter has bash installed on their phone. It is not in stock Android as far as I can tell, nor is it on my manually rooted Nexus 5. What the rooting tools install I don't know, it might include bash.