Shellshock - Revision history

NKirnbauer: fixed link

2024-09-26T08:34:32Z

fixed link

← Older revision		Revision as of 08:34, 26 September 2024
Line 134:		Line 134:

	==== Yahoo! Server ====		==== Yahoo! Server ====
	Cybersecurity expert Jonathan Hall discovered that romanian hackers exploited the Shellshock vulnerability to breach [https://en.wikipedia.org/wiki/Yahoo! Yahoo!] servers. They specifically targeted access points to the [https://en.wikipedia.org/wiki/Yahoo!_Games Yahoo! Games] network, which has millions of users. The servers were vulnerable due to using an outdated version of Bash. Yahoo confirmed the incidents, stating they responded with patches and isolated some affected servers. However, at that time, there was no evidence of compromised user data. <ref name="boren-romanian-hackers">Zachary Davies Boren. [https://www.independent.co.uk/tech/shellshock-romanian-hackers-are-accessing-yahoo-servers-claims-security-ex html/ ''Shellshock: Romanian Hackers Are Accessing Yahoo Servers, Claims Security Expert''], 2014. Retrieved December 17, 2023.</ref><ref name="hall-yahoo-shellshocked">Jonathan Hall. [https://web.archive.org/web/20141009075833/http://www.futuresouth.us/wordpress/?p=5 ''Yahoo! Shellshocked Like Ninja Turtles!''], 2014. Retrieved December 17, 2023.</ref>		Cybersecurity expert Jonathan Hall discovered that romanian hackers exploited the Shellshock vulnerability to breach [https://en.wikipedia.org/wiki/Yahoo! Yahoo!] servers. They specifically targeted access points to the [https://en.wikipedia.org/wiki/Yahoo!_Games Yahoo! Games] network, which has millions of users. The servers were vulnerable due to using an outdated version of Bash. Yahoo confirmed the incidents, stating they responded with patches and isolated some affected servers. However, at that time, there was no evidence of compromised user data. <ref name="boren-romanian-hackers">Zachary Davies Boren. [https://www.independent.co.uk/tech/shellshock-romanian-hackers-are-accessing-yahoo-servers-claims-security-expert-9777753.html ''Shellshock: Romanian Hackers Are Accessing Yahoo Servers, Claims Security Expert''], 2014. Retrieved December 17, 2023.</ref><ref name="hall-yahoo-shellshocked">Jonathan Hall. [https://web.archive.org/web/20141009075833/http://www.futuresouth.us/wordpress/?p=5 ''Yahoo! Shellshocked Like Ninja Turtles!''], 2014. Retrieved December 17, 2023.</ref>

	==== DDoS Attacks ====		==== DDoS Attacks ====

NKirnbauer: fixed link

2024-09-26T08:33:07Z

fixed link

← Older revision		Revision as of 08:33, 26 September 2024
Line 12:		Line 12:
	=== Discovery ===		=== Discovery ===
	The collective discovery of Shellshock's related vulnerabilities unfolded in 2014, starting with Stéphane Chazelas, a French software developer, uncovering the initial bug, CVE-2014-6271 ([https://nvd.nist.gov/vuln/ Common Vulnerability and Exposures, CVE]), which he originally called ''Bashdoor''.		The collective discovery of Shellshock's related vulnerabilities unfolded in 2014, starting with Stéphane Chazelas, a French software developer, uncovering the initial bug, CVE-2014-6271 ([https://nvd.nist.gov/vuln/ Common Vulnerability and Exposures, CVE]), which he originally called ''Bashdoor''.
	The vulnerability was a significant flaw in the Bash shell, which had gone unnoticed for over two decades. <ref name="grubb-chazelas">Ben Grubb. [https://www.smh.com.au/technology/stephane-chazelas-the-man-who-found-the-webs-most-dangerous-internet-~~securhtml/~~ ''Stephane Chazelas: The Man Who Found the Web's 'Most Dangerous' Internet Security Bug''], 2014. Retrieved December 17, 2023.</ref>		The vulnerability was a significant flaw in the Bash shell, which had gone unnoticed for over two decades. <ref name="grubb-chazelas">Ben Grubb. [https://www.smh.com.au/technology/stephane-chazelas-the-man-who-found-the-webs-most-dangerous-internet-security-bug-20140926-10mixr.html ''Stephane Chazelas: The Man Who Found the Web's 'Most Dangerous' Internet Security Bug''], 2014. Retrieved December 17, 2023.</ref>

	Upon its discovery, it was quickly recognized for the potential to allow attackers to execute arbitrary code on affected systems <ref name="nist-cve-2014-6271">National Institute of Standards and Technology (NIST). [https://nvd.nist.gov/vuln/detail/CVE-2014-6271/ ''CVE-2014-6271 Detail''], 2021. Retrieved December 18, 2023.</ref>.		Upon its discovery, it was quickly recognized for the potential to allow attackers to execute arbitrary code on affected systems <ref name="nist-cve-2014-6271">National Institute of Standards and Technology (NIST). [https://nvd.nist.gov/vuln/detail/CVE-2014-6271/ ''CVE-2014-6271 Detail''], 2021. Retrieved December 18, 2023.</ref>.

NKirnbauer: expired link changed with link from wayback machine

2024-09-26T08:30:35Z

expired link changed with link from wayback machine

← Older revision		Revision as of 08:30, 26 September 2024
Line 115:		Line 115:

	==== Dynamic Host Configuration Protocol (DHCP) ====		==== Dynamic Host Configuration Protocol (DHCP) ====
	Exploiting Shellshock through [https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol DHCP] involved attackers setting up rogue DHCP servers. When a vulnerable system (client), using Bash to process DHCP responses, connected to this server, it would receive maliciously crafted DHCP responses. These responses included environment variables typically designed to perform ACE. <ref name="enache-shellshock">Tudor Enache. [https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf ''Shellshock Vulnerability''], 2014. Retrieved December 17, 2023.</ref>		Exploiting Shellshock through [https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol DHCP] involved attackers setting up rogue DHCP servers. When a vulnerable system (client), using Bash to process DHCP responses, connected to this server, it would receive maliciously crafted DHCP responses. These responses included environment variables typically designed to perform ACE. <ref name="enache-shellshock">Tudor Enache. [http://web.archive.org/web/20220125061940/https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf ''Shellshock Vulnerability''], 2014. Retrieved December 17, 2023.</ref>

	Since DHCP is used for automatically configuring network settings, this attack vector could be employed in any network environment, making it particularly dangerous in public or unsecured Wi-Fi networks.		Since DHCP is used for automatically configuring network settings, this attack vector could be employed in any network environment, making it particularly dangerous in public or unsecured Wi-Fi networks.

OHieke: Added a shellshock logo

2024-01-08T01:29:38Z

Added a shellshock logo

← Older revision		Revision as of 01:29, 8 January 2024
Line 1:		Line 1:
	Shellshock, discovered in 2014, is a family of significant vulnerabilities in the GNU Bash shell, affecting a wide range of systems. It enables attackers to execute arbitrary code ([https://en.wikipedia.org/wiki/Arbitrary_code_execution Arbitrary Code Execution], ACE) on vulnerable systems, exploiting environment variables in Bash. The severity of Shellshock lies in its widespread impact, targeting systems running Bash, including web servers, DHCP clients, and network services.		Shellshock, discovered in 2014, is a family of significant vulnerabilities in the GNU Bash shell, affecting a wide range of systems. It enables attackers to execute arbitrary code ([https://en.wikipedia.org/wiki/Arbitrary_code_execution Arbitrary Code Execution], ACE) on vulnerable systems, exploiting environment variables in Bash. The severity of Shellshock lies in its widespread impact, targeting systems running Bash, including web servers, DHCP clients, and network services.

			[[File:Shellshock-logo.png\|thumb\|right\|A Shellshock logo <ref name="shellshock-logo">https://en.wikipedia.org/wiki/Shellshock_(software_bug)</ref>]]

	== Background ==		== Background ==

OHieke: Made some minor changes to several parts of the whole wiki entry

2024-01-08T01:02:51Z

Made some minor changes to several parts of the whole wiki entry

← Older revision		Revision as of 01:02, 8 January 2024
Line 1:		Line 1:
	Shellshock, discovered in 2014, is a significant ~~vulnerability~~ in the GNU Bash shell, affecting a wide range of systems. It enables attackers to execute arbitrary code on vulnerable systems, exploiting environment variables in Bash. The severity of Shellshock lies in its widespread impact, targeting systems running Bash, including web servers, DHCP clients, and network services.		Shellshock, discovered in 2014, is a family of significant vulnerabilities in the GNU Bash shell, affecting a wide range of systems. It enables attackers to execute arbitrary code ([https://en.wikipedia.org/wiki/Arbitrary_code_execution Arbitrary Code Execution], ACE) on vulnerable systems, exploiting environment variables in Bash. The severity of Shellshock lies in its widespread impact, targeting systems running Bash, including web servers, DHCP clients, and network services.

	== Background ==		== Background ==

	=== Bash Shell ===		=== Bash Shell ===
	The GNU Bourne Again Shell ([https://en.wikipedia.org/wiki/Bash_(Unix_shell) Bash]), introduced in 1989 by Brian Fox, is a widely used command-line interface in Unix-like operating systems. Renowned for its flexibility and extensive feature set, Bash combines capabilities from various other shells, such as the ~~Korn Shell~~ (ksh) and the C-Shell (csh) <ref name="bash-reference-manual">Chet Ramey and Brian Fox. ''Bash Reference Manual'', Free Software Foundation, 5.2 edition, 2022.</ref>.		The GNU Bourne Again Shell ([https://en.wikipedia.org/wiki/Bash_(Unix_shell) Bash]), introduced in 1989 by Brian Fox, is a widely used command-line interface (CLI) in Unix-like operating systems. Renowned for its flexibility and extensive feature set, Bash combines capabilities from various other shells, such as the [https://en.wikipedia.org/wiki/KornShell KornShell] (ksh) and the [https://en.wikipedia.org/wiki/C_shell C Shell] (csh) <ref name="bash-reference-manual">Chet Ramey and Brian Fox. ''Bash Reference Manual'', Free Software Foundation, 5.2 edition, 2022.</ref>.

	However, this complexity also introduced vulnerabilities, as highlighted by the Shellshock incident. Bash's integral role in numerous systems and devices across networks <ref name="broberg-bash-shell">Matthew Broberg. [https://opensource.com/19/9/command-line-heroes-bash/ ''The Birth of the Bash Shell''], 2019. Retrieved December 17, 2023.</ref> significantly amplified the impact of these vulnerabilities, underlining the importance of secure shell programming and system design.		However, this complexity also introduced vulnerabilities, as highlighted by the Shellshock incident. Bash's integral role in numerous systems and devices across networks <ref name="broberg-bash-shell">Matthew Broberg. [https://opensource.com/19/9/command-line-heroes-bash/ ''The Birth of the Bash Shell''], 2019. Retrieved December 17, 2023.</ref> significantly amplified the impact of these vulnerabilities, underlining the importance of secure shell programming and system design.

	=== Discovery ===		=== Discovery ===
	The discovery of Shellshock ~~and its~~ related vulnerabilities unfolded in 2014, starting with Stéphane Chazelas, a French software developer, uncovering the initial bug, CVE-2014-6271 ([https://nvd.nist.gov/vuln/ Common Vulnerability and Exposures, CVE]).		The collective discovery of Shellshock's related vulnerabilities unfolded in 2014, starting with Stéphane Chazelas, a French software developer, uncovering the initial bug, CVE-2014-6271 ([https://nvd.nist.gov/vuln/ Common Vulnerability and Exposures, CVE]), which he originally called ''Bashdoor''.
	The vulnerability, which had gone unnoticed for over two decades~~, was a significant flaw in the Bash shell~~. <ref name="grubb-chazelas">Ben Grubb. [https://www.smh.com.au/technology/stephane-chazelas-the-man-who-found-the-webs-most-dangerous-internet-securhtml/ ''Stephane Chazelas: The Man Who Found the Web's 'Most Dangerous' Internet Security Bug''], 2014. Retrieved December 17, 2023.</ref>		The vulnerability was a significant flaw in the Bash shell, which had gone unnoticed for over two decades. <ref name="grubb-chazelas">Ben Grubb. [https://www.smh.com.au/technology/stephane-chazelas-the-man-who-found-the-webs-most-dangerous-internet-securhtml/ ''Stephane Chazelas: The Man Who Found the Web's 'Most Dangerous' Internet Security Bug''], 2014. Retrieved December 17, 2023.</ref>

	Upon its discovery, it was quickly recognized for the potential to allow attackers to execute arbitrary code ~~(Arbitrary Code Execution, ACE)~~ on affected systems <ref name="nist-cve-2014-6271">National Institute of Standards and Technology (NIST). [https://nvd.nist.gov/vuln/detail/CVE-2014-6271/ ''CVE-2014-6271 Detail''], 2021. Retrieved December 18, 2023.</ref>.		Upon its discovery, it was quickly recognized for the potential to allow attackers to execute arbitrary code on affected systems <ref name="nist-cve-2014-6271">National Institute of Standards and Technology (NIST). [https://nvd.nist.gov/vuln/detail/CVE-2014-6271/ ''CVE-2014-6271 Detail''], 2021. Retrieved December 18, 2023.</ref>.
	The revelation of Shellshock prompted an immediate and coordinated response from the software community, leading to rapid development of patches by Bash's lead developer, Chet Ramey, and widespread updates across various operating systems and networked devices <ref name="grubb-chazelas"></ref>.		The revelation of Shellshock prompted an immediate and coordinated response from the software community, leading to rapid development of patches by Bash's lead developer, Chet Ramey, and widespread updates across various operating systems and networked devices <ref name="grubb-chazelas"></ref>.

Line 45:		Line 45:

	=== CVE-2014-7186 ===		=== CVE-2014-7186 ===
	Another vulnerability, which didn't execute malicious code but was used to carry out DoS attacks by causing memory overflow and application crashes, or other unexpected behavior in Bash <ref name="nist-cve-2014-7186">National Institute of Standards and Technology (NIST). [https://nvd.nist.gov/vuln/detail/CVE-2014-7186/ ''CVE-2014-7186 Detail''], 2018. Retrieved December 17, 2023.</ref><ref name="florian-weimer-bash-patches">Florian Weimer. [https://www.openwall.com/lists/oss-security/2014/09/25/32 ''Non-Upstream Patches for Bash''], 2014. Retrieved December 17, 2023.</ref><ref name="michal-zalewski-bash-bug">Michał Zalewski. [https://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html ''Bash Bug: The Other Two RCEs, or How We Chipped Away at the Original Fix (CVE-2014-6277 and '78)''], 2014. Retrieved December 17, 2023.</ref>.		Another vulnerability, which didn't execute malicious code but was used to carry out [https://en.wikipedia.org/wiki/Denial-of-service_attack denial-of-service] (DoS) attacks by causing memory overflow and application crashes, or other unexpected behavior in Bash <ref name="nist-cve-2014-7186">National Institute of Standards and Technology (NIST). [https://nvd.nist.gov/vuln/detail/CVE-2014-7186/ ''CVE-2014-7186 Detail''], 2018. Retrieved December 17, 2023.</ref><ref name="florian-weimer-bash-patches">Florian Weimer. [https://www.openwall.com/lists/oss-security/2014/09/25/32 ''Non-Upstream Patches for Bash''], 2014. Retrieved December 17, 2023.</ref><ref name="michal-zalewski-bash-bug">Michał Zalewski. [https://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html ''Bash Bug: The Other Two RCEs, or How We Chipped Away at the Original Fix (CVE-2014-6277 and '78)''], 2014. Retrieved December 17, 2023.</ref>.

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
Line 51:		Line 51:
	</syntaxhighlight>		</syntaxhighlight>

	In the example above, a series of ''here documents'' are nested within the function body, but they are never closed with a delimiter. Each <code><<EOF</code> opens a new document, which typically needs to be closed with the matching delimiter ~~<code>~~EOF~~</code>~~. Everything between these two points is considered the content of the document <ref name="mendel-cooper-bash-scripting-guide">Mendel Cooper. [https://tldp.org/LDP/abs/html/here-docs.html ''Advanced Bash-Scripting Guide: Chapter 19. Here Documents''], 2014. Retrieved December 17, 2023.</ref>.		In the example above, a series of ''here documents'' are nested within the function body, but they are never closed with a delimiter. Each <code><<EOF</code> opens a new document, which typically needs to be closed with the matching delimiter "EOF". Everything between these two points is considered the content of the document <ref name="mendel-cooper-bash-scripting-guide">Mendel Cooper. [https://tldp.org/LDP/abs/html/here-docs.html ''Advanced Bash-Scripting Guide: Chapter 19. Here Documents''], 2014. Retrieved December 17, 2023.</ref>.

	The security vulnerability arises from the missing closing delimiters, combined with the deep nesting, causing an ~~Out~~-Of-~~Bounds Memory~~-~~Access-Error~~.		The security vulnerability arises from the missing closing delimiters, combined with the deep nesting, causing an out-of-bounds memory-access error.

	=== CVE-2014-7187 ===		=== CVE-2014-7187 ===
	A software crash and subsequent DoS can be caused by an Off-By-~~One~~ error due to a flaw in the ''~~read token word~~'' function found in the ''parse.y'' file within the Bash source code <ref name="nist-cve-2014-7187">National Institute of Standards and Technology (NIST). [https://nvd.nist.gov/vuln/detail/CVE-2014-7187/ ''CVE-2014-7187 Detail''], 2018. Retrieved December 17, 2023.</ref><ref name="florian-weimer-bash-patches"></ref><ref name="michal-zalewski-bash-bug"></ref>.		A software crash and subsequent DoS can be caused by an [https://en.wikipedia.org/wiki/Off-by-one_error off-by-one error] due to a flaw in the ''read_token_word'' function found in the ''parse.y'' file within the Bash source code <ref name="nist-cve-2014-7187">National Institute of Standards and Technology (NIST). [https://nvd.nist.gov/vuln/detail/CVE-2014-7187/ ''CVE-2014-7187 Detail''], 2018. Retrieved December 17, 2023.</ref><ref name="florian-weimer-bash-patches"></ref><ref name="michal-zalewski-bash-bug"></ref>.

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
Line 63:		Line 63:
	</syntaxhighlight>		</syntaxhighlight>

	When using a for loop, the output of <code>echo</code> commands is written to the target file ''test-script.sh'', which is executed afterward. The resulting deeply nested loops can cause Bash to mishandle them, leading to an ~~Off~~-By-~~One~~ error in memory access.		When using a for loop, the output of <code>echo</code> commands is written to the target file ''test-script.sh'', which is executed afterward. The resulting deeply nested loops can cause Bash to mishandle them, leading to an off-by-one error in memory access.

	This can result in accessing memory outside the allocated range, potentially leading to application crashes.		This can result in accessing memory outside the allocated range, potentially leading to application crashes.
Line 76:		Line 76:
	In this command, after two empty functions <code>y() { _; }</code>, the ''<<'' operator starts a ''here document''. However, due to the missing delimiter string, the it is not fully terminated. As a result, the ''here_doc_eof'' pointer incorrectly points to an invalid string and remains uninitialized. Consequently, Bash could attempt to read from this uninitialized memory that has been manipulated by attackers.		In this command, after two empty functions <code>y() { _; }</code>, the ''<<'' operator starts a ''here document''. However, due to the missing delimiter string, the it is not fully terminated. As a result, the ''here_doc_eof'' pointer incorrectly points to an invalid string and remains uninitialized. Consequently, Bash could attempt to read from this uninitialized memory that has been manipulated by attackers.

	This could result in unexpected behavior such as ~~Arbitrary Code Execution (~~ACE) or software crashes.		This could result in unexpected behavior such as ACE or software crashes.

	=== CVE-2014-6278 ===		=== CVE-2014-6278 ===
Line 135:		Line 135:

	==== DDoS Attacks ====		==== DDoS Attacks ====
	Within a day of Shellshock's disclosure, attackers exploited the Bash vulnerability to create a [https://en.wikipedia.org/wiki/Botnet botnet] named wopbot. This botnet targeted vulnerable servers, launching ~~[https://en.wikipedia.org/wiki/Denial-of-service_attack~~ distributed ~~denial-of-service]~~ (DDoS) attacks against [https://en.wikipedia.org/wiki/Akamai_Technologies Akamai's] [https://en.wikipedia.org/wiki/Content_delivery_network content delivery network] (CDN) servers and attempting to compromise the U.S. Defense Department's network, which includes about 16.7 million IP addresses. While [https://en.wikipedia.org/wiki/Tiger_(security_software) Tiger Security] experts partially shut down the botnet's control systems, the botmaster server of wopbot remains operational, continuing to spread malware. <ref name="saarinen-shellshock-botnet">Juha Saarinen. [https://www.itnews.com.au/news/first-shellshock-botnet-attacks-akamai-us-dod-networks-396197/ ''First Shellshock Botnet Attacks Akamai, US DoD Networks''], 2014. Retrieved December 17, 2023.</ref>		Within a day of Shellshock's disclosure, attackers exploited the Bash vulnerability to create a [https://en.wikipedia.org/wiki/Botnet botnet] named wopbot. This botnet targeted vulnerable servers, launching distributed DoS (DDoS) attacks against [https://en.wikipedia.org/wiki/Akamai_Technologies Akamai's] [https://en.wikipedia.org/wiki/Content_delivery_network content delivery network] (CDN) servers and attempting to compromise the U.S. Defense Department's network, which includes about 16.7 million IP addresses. While [https://en.wikipedia.org/wiki/Tiger_(security_software) Tiger Security] experts partially shut down the botnet's control systems, the botmaster server of wopbot remains operational, continuing to spread malware. <ref name="saarinen-shellshock-botnet">Juha Saarinen. [https://www.itnews.com.au/news/first-shellshock-botnet-attacks-akamai-us-dod-networks-396197/ ''First Shellshock Botnet Attacks Akamai, US DoD Networks''], 2014. Retrieved December 17, 2023.</ref>

	==== Other Attacks ====		==== Other Attacks ====
Line 153:		Line 153:

	== References ==		== References ==

			[[Category:Documentation]]

OHieke: Added the description for chapter "Defense and Mitigation Strategies", along with citations

2024-01-08T00:26:36Z

Added the description for chapter "Defense and Mitigation Strategies", along with citations

← Older revision		Revision as of 00:26, 8 January 2024
Line 140:		Line 140:
	According to a report by Solutionary’s Security Engineering Research Team (SERT), the Shellshock vulnerability was still being exploited ten months after its disclosure. Despite available protections, many systems remained vulnerable. Nearly 600,000 Shellshock-related events originated from over 25,000 unique IP addresses, mostly trying to identify susceptible systems. The USA, China, Korea, the UK, Germany, and Japan were the top sources of these attacks, with educational institutions being primary targets. Most successful attacks involved downloading and executing Bash scripts, with various attackers, including known botnets, continuing to exploit the vulnerability. <ref name="kovacs-shellshock-exploited">Eduard Kovacs. [https://www.securityweek.com/shellshock-flaw-still-actively-exploited-solutionary/ ''Shellshock Flaw Still Actively Exploited: Solutionary''], 2015. Retrieved December 17, 2023.</ref>		According to a report by Solutionary’s Security Engineering Research Team (SERT), the Shellshock vulnerability was still being exploited ten months after its disclosure. Despite available protections, many systems remained vulnerable. Nearly 600,000 Shellshock-related events originated from over 25,000 unique IP addresses, mostly trying to identify susceptible systems. The USA, China, Korea, the UK, Germany, and Japan were the top sources of these attacks, with educational institutions being primary targets. Most successful attacks involved downloading and executing Bash scripts, with various attackers, including known botnets, continuing to exploit the vulnerability. <ref name="kovacs-shellshock-exploited">Eduard Kovacs. [https://www.securityweek.com/shellshock-flaw-still-actively-exploited-solutionary/ ''Shellshock Flaw Still Actively Exploited: Solutionary''], 2015. Retrieved December 17, 2023.</ref>

	==Defense and Mitigation Strategies==		== Defense and Mitigation Strategies ==

	===Patches and Updates===		=== Patches and Updates ===
	~~Rapid development~~ and ~~distribution of~~ patches ~~for each~~ CVE ~~were crucial in mitigating~~ Shellshock. ~~Regular~~ system ~~updates and applying patches are critical for maintaining security~~.		In the course of the six vulnerabilities' discoveries, Chet Ramey released three patches named [http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-025 ''bash43-025''], [http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-026 ''bash43-026''], and [http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027 ''bash43-027''], primarily addressing the issues in CVE-2014-6271, CVE-2014-7169, and CVE-2014-7186, with the last one also addressing all remaining ones <ref name="constantin-improved-patch">Lucian Constantin. [https://www.pcworld.com/article/435506/improved-patch-tackles-new-shellshock-attack-vectors.html ''Improved Patch Tackles New Shellshock Bash Bug Attack Vectors''], 2014. Retrieved December 17, 2023.</ref>.
			The patching process itself varies depending on the operating system but typically includes the following basic steps <ref name="anicas-shellshock-protection">Mitchell Anicas. [https://www.digitalocean.com/community/tutorials/how-to-protect-your-server-against-the-shellshock-bash-vulnerability ''How to Protect Your Server Against the Shellshock Bash Vulnerability''], 2014. Retrieved December 17, 2023.</ref>:

	~~===Best Practices===~~		* '''Updating repository information:''' To ensure that the package manager being used is up to date and includes the latest updates and security patches, an ''update'' command is executed. <br> For Debian-based systems: <code>apt-get update</code> <br> For Red Hat-based systems: <code>yum update</code>
	~~Adopting best practices~~, ~~such as minimal~~ installation ~~to reduce attack surfaces~~, ~~adhering~~ to the ~~principle~~ of ~~least privilege~~, ~~regular security audits~~, ~~and employee training~~, ~~are essential strategies to~~ prevent ~~similar vulnerabilities~~.
			* '''Updating Bash:''' To update the Bash package, the appropriate command provided for the system is used. <br> For Debian-based systems: <code>apt-get install --only-upgrade bash</code> <br> For Red Hat-based systems: <code>yum update bash</code>

			* '''Verification of installation:''' To verify the functionality of the patch, it's essential to test the system for the security vulnerability. Depending on the specific variant of the vulnerability (see section Attack Vectors), this can be done, for example, by entering the following command: <br> <syntaxhighlight lang="bash">env x=’() { :;}; echo vulnerable’ bash -c "echo test"</syntaxhighlight> A non-vulnerable system should prevent the execution of code after a function definition and instead provide an error message.

	== References ==		== References ==

OHieke: Added "References" sections

2024-01-07T23:12:19Z

Added "References" sections

← Older revision		Revision as of 23:12, 7 January 2024
Line 1:		Line 1:
	Shellshock, discovered in 2014, is a significant vulnerability in the GNU Bash shell, affecting a wide range of systems. It enables attackers to execute arbitrary code on vulnerable systems, exploiting environment variables in Bash. The severity of Shellshock lies in its widespread impact, targeting systems running Bash, including web servers, DHCP clients, and network services.		Shellshock, discovered in 2014, is a significant vulnerability in the GNU Bash shell, affecting a wide range of systems. It enables attackers to execute arbitrary code on vulnerable systems, exploiting environment variables in Bash. The severity of Shellshock lies in its widespread impact, targeting systems running Bash, including web servers, DHCP clients, and network services.


	== Background ==		== Background ==
Line 148:		Line 147:
	===Best Practices===		===Best Practices===
	Adopting best practices, such as minimal installation to reduce attack surfaces, adhering to the principle of least privilege, regular security audits, and employee training, are essential strategies to prevent similar vulnerabilities.		Adopting best practices, such as minimal installation to reduce attack surfaces, adhering to the principle of least privilege, regular security audits, and employee training, are essential strategies to prevent similar vulnerabilities.

			== References ==

OHieke: Added the description for chapter "Impact and Attack Scenarios", along with citations

2024-01-07T23:11:30Z

Added the description for chapter "Impact and Attack Scenarios", along with citations

@@ Line 90: / Line 90: @@
 Because of this, the following code block <code>{ echo vulnerable; id; }</code> is executed without further checks.
-==Impact and Attack Scenarios==
+== Impact and Attack Scenarios ==
 ===Examples of Attacks===
-Notable instances include a suspected attack on a voting server in Georgia, a worm targeting QNAP NAS devices, and unauthorized access to Yahoo servers. These examples highlight the broad and severe implications of Shellshock in real-world scenarios.
+Shellshock was exploited in various notable attacks.
 ==Defense and Mitigation Strategies==

OHieke: Added the description for chapter "Background", along with citations

2024-01-07T20:03:03Z

Added the description for chapter "Background", along with citations

← Older revision		Revision as of 20:03, 7 January 2024
Line 2:		Line 2:


	==Background==		== Background ==

	===Bash Shell===		=== Bash Shell ===
	The GNU Bourne Again Shell (Bash) is a widely used command ~~processor~~ in Unix-like operating systems. ~~Its design~~, ~~integrating features~~ from other shells, ~~makes it versatile but also introduced vulnerabilities exploited by Shellshock~~.		The GNU Bourne Again Shell ([https://en.wikipedia.org/wiki/Bash_(Unix_shell) Bash]), introduced in 1989 by Brian Fox, is a widely used command-line interface in Unix-like operating systems. Renowned for its flexibility and extensive feature set, Bash combines capabilities from various other shells, such as the Korn Shell (ksh) and the C-Shell (csh) <ref name="bash-reference-manual">Chet Ramey and Brian Fox. ''Bash Reference Manual'', Free Software Foundation, 5.2 edition, 2022.</ref>.

	~~===Discovery===~~		However, this complexity also introduced vulnerabilities, as highlighted by the Shellshock incident. Bash's integral role in numerous systems and devices across networks <ref name="broberg-bash-shell">Matthew Broberg. [https://opensource.com/19/9/command-line-heroes-bash/ ''The Birth of the Bash Shell''], 2019. Retrieved December 17, 2023.</ref> significantly amplified the impact of these vulnerabilities, underlining the importance of secure shell programming and system design.
	~~Discovered~~ by ~~Stéphane Chazelas~~ in ~~September 2014, Shellshock was initially identified as CVE~~-~~2014~~-~~6271~~. ~~Further investigation revealed additional related vulnerabilities~~, ~~underscoring~~ the ~~security implications~~ of the ~~widespread use~~ of ~~Bash~~.

			=== Discovery ===
			The discovery of Shellshock and its related vulnerabilities unfolded in 2014, starting with Stéphane Chazelas, a French software developer, uncovering the initial bug, CVE-2014-6271 ([https://nvd.nist.gov/vuln/ Common Vulnerability and Exposures, CVE]).
			The vulnerability, which had gone unnoticed for over two decades, was a significant flaw in the Bash shell. <ref name="grubb-chazelas">Ben Grubb. [https://www.smh.com.au/technology/stephane-chazelas-the-man-who-found-the-webs-most-dangerous-internet-securhtml/ ''Stephane Chazelas: The Man Who Found the Web's 'Most Dangerous' Internet Security Bug''], 2014. Retrieved December 17, 2023.</ref>

			Upon its discovery, it was quickly recognized for the potential to allow attackers to execute arbitrary code (Arbitrary Code Execution, ACE) on affected systems <ref name="nist-cve-2014-6271">National Institute of Standards and Technology (NIST). [https://nvd.nist.gov/vuln/detail/CVE-2014-6271/ ''CVE-2014-6271 Detail''], 2021. Retrieved December 18, 2023.</ref>.
			The revelation of Shellshock prompted an immediate and coordinated response from the software community, leading to rapid development of patches by Bash's lead developer, Chet Ramey, and widespread updates across various operating systems and networked devices <ref name="grubb-chazelas"></ref>.

			Furthermore, it led to the identification of six distinct CVEs, ranging from CVE-2014-6271 to CVE-2014-7187, each highlighting various vulnerabilities in Bash's handling of code parsing and execution <ref name="zdnet-betterbash">Steven Vaughan-Nichols. [https://www.zdnet.com/article/shellshock-better-bash-patches-now-available/ ''Shellshock: Better 'bash' patches now available''], 2014. Retrieved December 17, 2023.</ref>.

	==Reported Vulnerabilities==		==Reported Vulnerabilities==

OHieke: Improved reference display in chapter "Reported Vulnerabilities"

2024-01-07T19:02:14Z

Improved reference display in chapter "Reported Vulnerabilities"

← Older revision		Revision as of 19:02, 7 January 2024
Line 14:		Line 14:

	=== CVE-2014-6271 ===		=== CVE-2014-6271 ===
	The original Shellshock vulnerability was based on how Bash processed environment variables and allowed attackers to execute arbitrary code on vulnerable systems <ref name="qualys-shellshock">Prutha Parikh. ~~''Bash Shellshock Command Injection Vulnerabilities'',~~ https://blog.qualys.com/vulnerabilities-threat-research/2014/09/24/bash-remote-code-execution-vulnerability-cve-2014-6271/, 2014. Retrieved December 17, 2023.</ref>.		The original Shellshock vulnerability was based on how Bash processed environment variables and allowed attackers to execute arbitrary code on vulnerable systems <ref name="qualys-shellshock">Prutha Parikh. [https://blog.qualys.com/vulnerabilities-threat-research/2014/09/24/bash-remote-code-execution-vulnerability-cve-2014-6271/ ''Bash Shellshock Command Injection Vulnerabilities''], 2014. Retrieved December 17, 2023.</ref>.

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
Line 39:		Line 39:

	=== CVE-2014-7186 ===		=== CVE-2014-7186 ===
	Another vulnerability, which didn't execute malicious code but was used to carry out DoS attacks by causing memory overflow and application crashes, or other unexpected behavior in Bash <ref name="nist-cve-2014-7186">National Institute of Standards and Technology (NIST). ~~''CVE-2014-7186 Detail'',~~ https://nvd.nist.gov/vuln/detail/CVE-2014-7186/, 2018. Retrieved December 17, 2023.</ref><ref name="florian-weimer-bash-patches">Florian Weimer. ~~''Non-Upstream Patches for Bash'',~~ https://www.openwall.com/lists/oss-security/2014/09/25/32, 2014. Retrieved December 17, 2023.</ref><ref name="michal-zalewski-bash-bug">Michał Zalewski. ''Bash Bug: The Other Two RCEs, or How We Chipped Away at the Original Fix (CVE-2014-6277 and '78)''~~, https://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html~~, 2014. Retrieved December 17, 2023.</ref>.		Another vulnerability, which didn't execute malicious code but was used to carry out DoS attacks by causing memory overflow and application crashes, or other unexpected behavior in Bash <ref name="nist-cve-2014-7186">National Institute of Standards and Technology (NIST). [https://nvd.nist.gov/vuln/detail/CVE-2014-7186/ ''CVE-2014-7186 Detail''], 2018. Retrieved December 17, 2023.</ref><ref name="florian-weimer-bash-patches">Florian Weimer. [https://www.openwall.com/lists/oss-security/2014/09/25/32 ''Non-Upstream Patches for Bash''], 2014. Retrieved December 17, 2023.</ref><ref name="michal-zalewski-bash-bug">Michał Zalewski. [https://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html ''Bash Bug: The Other Two RCEs, or How We Chipped Away at the Original Fix (CVE-2014-6277 and '78)''], 2014. Retrieved December 17, 2023.</ref>.

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
Line 45:		Line 45:
	</syntaxhighlight>		</syntaxhighlight>

	In the example above, a series of ''here documents'' are nested within the function body, but they are never closed with a delimiter. Each <code><<EOF</code> opens a new document, which typically needs to be closed with the matching delimiter <code>EOF</code>. Everything between these two points is considered the content of the document <ref name="mendel-cooper-bash-scripting-guide">Mendel Cooper. ~~''Advanced Bash-Scripting Guide: Chapter 19. Here Documents'',~~ https://tldp.org/LDP/abs/html/here-docs.html, 2014. Retrieved December 17, 2023.</ref>.		In the example above, a series of ''here documents'' are nested within the function body, but they are never closed with a delimiter. Each <code><<EOF</code> opens a new document, which typically needs to be closed with the matching delimiter <code>EOF</code>. Everything between these two points is considered the content of the document <ref name="mendel-cooper-bash-scripting-guide">Mendel Cooper. [https://tldp.org/LDP/abs/html/here-docs.html ''Advanced Bash-Scripting Guide: Chapter 19. Here Documents''], 2014. Retrieved December 17, 2023.</ref>.

	The security vulnerability arises from the missing closing delimiters, combined with the deep nesting, causing an Out-Of-Bounds Memory-Access-Error.		The security vulnerability arises from the missing closing delimiters, combined with the deep nesting, causing an Out-Of-Bounds Memory-Access-Error.

	=== CVE-2014-7187 ===		=== CVE-2014-7187 ===
	A software crash and subsequent DoS can be caused by an Off-By-One error due to a flaw in the ''read token word'' function found in the ''parse.y'' file within the Bash source code <ref name="nist-cve-2014-7187">National Institute of Standards and Technology (NIST). ~~''CVE-2014-7187 Detail'',~~ https://nvd.nist.gov/vuln/detail/CVE-2014-7187/, 2018. Retrieved December 17, 2023.</ref><ref name="florian-weimer-bash-patches"></ref><ref name="michal-zalewski-bash-bug"></ref>.		A software crash and subsequent DoS can be caused by an Off-By-One error due to a flaw in the ''read token word'' function found in the ''parse.y'' file within the Bash source code <ref name="nist-cve-2014-7187">National Institute of Standards and Technology (NIST). [https://nvd.nist.gov/vuln/detail/CVE-2014-7187/ ''CVE-2014-7187 Detail''], 2018. Retrieved December 17, 2023.</ref><ref name="florian-weimer-bash-patches"></ref><ref name="michal-zalewski-bash-bug"></ref>.

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
Line 62:		Line 62:

	=== CVE-2014-6277 ===		=== CVE-2014-6277 ===
	Another security vulnerability, in contrast to the previous weaknesses, is related to uninitialized memory usage. This faulty memory access could lead to DoS or the execution of malicious code <ref name="nist-cve-2014-6277">National Institute of Standards and Technology (NIST). ~~''CVE-2014-6277 Detail'',~~ https://nvd.nist.gov/vuln/detail/CVE-2014-6277/, 2018. Retrieved December 17, 2023.</ref>. A detailed explanation of this issue can be found in a personal blog post <ref name="michal-zalewski-bash-bug"></ref> by Michał Zalewski.		Another security vulnerability, in contrast to the previous weaknesses, is related to uninitialized memory usage. This faulty memory access could lead to DoS or the execution of malicious code <ref name="nist-cve-2014-6277">National Institute of Standards and Technology (NIST). [https://nvd.nist.gov/vuln/detail/CVE-2014-6277/ ''CVE-2014-6277 Detail''], 2018. Retrieved December 17, 2023.</ref>. A detailed explanation of this issue can be found in a personal blog post <ref name="michal-zalewski-bash-bug"></ref> by Michał Zalewski.

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
Line 73:		Line 73:

	=== CVE-2014-6278 ===		=== CVE-2014-6278 ===
	This more complex security vulnerability allowed attackers to bypass the previously published patches through redirection and parsing errors, ultimately enabling the execution of malicious code <ref name="nist-cve-2014-6278">National Institute of Standards and Technology (NIST). ~~''CVE-2014-6278 Detail'',~~ https://nvd.nist.gov/vuln/detail/CVE-2014-6278/, 2021. Retrieved December 17, 2023.</ref><ref name="michal-zalewski-bash-bug"></ref>.		This more complex security vulnerability allowed attackers to bypass the previously published patches through redirection and parsing errors, ultimately enabling the execution of malicious code <ref name="nist-cve-2014-6278">National Institute of Standards and Technology (NIST). [https://nvd.nist.gov/vuln/detail/CVE-2014-6278/ ''CVE-2014-6278 Detail''], 2021. Retrieved December 17, 2023.</ref><ref name="michal-zalewski-bash-bug"></ref>.

	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">