Bash shell Code Injection 윤신필립 하승범

1.What is ShellShock. 2.Background Knowledge. 3.Shellshock CVE Additional vulnerabilities 5.Dangerousness of this Vulnerability. 6.Way of Solutions.

What is Shellshock ? CVE Disclosed by Akamai Technology of Stephane Chazelas on 24 September CVE , CVE , CVE , CVE , CVE

How to set environment variable?

Bash Architecture Run bash initialization Bash environment variable Print Bash shell prompt Wait instruction Save inst to string and parsing Run instruction

How to set environment variable?

Principle of CVE Use parse_and_execute() function int parse_and_execute (string, from_file, flags) {... while (*(bash_input.location.string)) {...

PATCH VERSION /* Don't import function names that are invalid identifiers from the environment, though we still allow them to be defined as shell variables. */ if (legal_identifier (name)) parse_and_execute(temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FINCDEF|SEVAL_ONECMD); Principle of CVE limit number of process check function

CVE DEMO

Additional vulnerabilities

CVE

CVE

CVE

Dangerousness of this Vulnerability

Attacker CGI PAGE Web Server virus Server invade & Destroy DB Server Bash 실행 HTTP PACKET Malicious commands Save in Environment variable

Way of Solutions UPDATE sudo apt-get upgrade sudo apt-get update Fedora, Redhat sudo yum update

Way of Solutions OS X bash Update 1.0 Mavericks Mountain Lion Lion

Way of Solutions Troy Hunt (Tremendous in-depth primer on Shellshock) In short, the advice to consumers is this: watch for security updates, particularly on OS X. Also keep an eye on any advice you may get from your ISP or other providers of devices you have that run embedded software. Do be cautious of s requesting information or instructing you to run software