[Cerowrt-devel] bash exploit heads up

[Cerowrt-devel] bash exploit heads up

[Dave Taht]

From fiddling with busybox's ash shell... thus far it *does NOT*
appear vulnerable to this.

http://linux.slashdot.org/story/14/09/24/1638207/remote-exploit-vulnerability-found-in-bash

Simple test:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

shows vulnerable for bash, not sh, on openwrt and cerowrt. That said,
it makes me nervous. I've never really liked the redir.sh method cero
uses to bounce people to the right web interface... suggestions to do
it in javascript or something safer desired.

and I'm aware that several people do run bash on cero, so be aware of
this issue.

-- 
Dave Täht

https://www.bufferbloat.net/projects/make-wifi-fast

Re: [Cerowrt-devel] bash exploit heads up

[Toke Høiland-Jørgensen]

[-- Attachment #1: Type: text/plain, Size: 660 bytes --]

Dave Taht <dave.taht@gmail.com> writes:

> shows vulnerable for bash, not sh, on openwrt and cerowrt. That said,
> it makes me nervous. I've never really liked the redir.sh method cero
> uses to bounce people to the right web interface... suggestions to do
> it in javascript or something safer desired.

Doesn't the value of $SERVER_NAME come from the (static) lighttpd
configuration? In that case, redir.sh can be replaced with a static HTML
page.

If not, it's probably doable in the lighttpd configuration if a suitable
redirect/rewrite module is available. I forget the syntax, though,
haven't used lighttpd in ages; I'm sure Google knows, though.

-Toke

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 472 bytes --]

Re: [Cerowrt-devel] bash exploit heads up

[Eric S. Johansson]

On 9/24/2014 5:45 PM, Dave Taht wrote:
> shows vulnerable for bash, not sh, on openwrt and cerowrt. That said,
> it makes me nervous. I've never really liked the redir.sh method cero
> uses to bounce people to the right web interface... suggestions to do
> it in javascript or something safer desired.
>

http://www.w3.org/QA/Tips/reback

I'll take a look in the next couple of days if no one beats me to it.

Re: [Cerowrt-devel] bash exploit heads up

[Eric S. Johansson]

On 9/24/2014 5:54 PM, Eric S. Johansson wrote:
>
> On 9/24/2014 5:45 PM, Dave Taht wrote:
>> shows vulnerable for bash, not sh, on openwrt and cerowrt. That said,
>> it makes me nervous. I've never really liked the redir.sh method cero
>> uses to bounce people to the right web interface... suggestions to do
>> it in javascript or something safer desired.
>>
>
> http://www.w3.org/QA/Tips/reback
>
> I'll take a look in the next couple of days if no one beats me to it.

looked a bit further. assuming you are still using lighthttpd, it looks 
like we should be able to to it from the lighthttp config
http://redmine.lighttpd.net/projects/1/wiki/docs_modredirect