Shell Shock / Bash vulnerability

ian darke

Is OpenVPN Access Server vulnerable?

http://www.troyhunt.com/2014/09/everything-you-need-to-know-about.html

debbie10t

Very interesting ...

From the blog you highlight:

What’s the bug?

Let me start with the CVE from NIST vulnerability database because it gives a good sense of the severity (highlight mine):

Which makes it pretty clear it is Bash bug.

Again from the blog you highlight:

I’m a system admin – what can I do?

Firstly, discovering if you’re at risk is trivial as it’s such an easily reproducible risk. There’s a very simple test The Register suggests which is just running this command within your shell:
env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"
You get “busted” echo’d back out and you’ve successfully exploited the bug.

So far all I get is "stuff" ...

Of course, this is a considerable bug and no doubt more related nasties will be pulled from the woodwork :twisted:

FYI: Access Server itself does not offer an attack vector to trigger the bug.

Traffic

debbie10t wroteCode:
env X="() { :;} ; echo busted" /bin/sh -c "echo stuff"

In fact is that test valid ?

[root@arch-live ~]
13:16:28 $ bash --version
GNU bash, version 4.3.18(1)-release (i686-pc-linux-gnu)
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
[root@arch-live ~]
13:16:46 $ env X="() { :;}; echo Shellshocked" bash -c 'echo Test done'
Shellshocked
Test done
[root@arch-live ~]
13:16:53 $

[root@arch-test ssh]# bash --version
GNU bash, version 4.3.26(1)-release (i686-pc-linux-gnu)
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
[root@arch-test ssh]# env X='() { :;}; echo Shellshocked' bash -c 'echo Test done'
Test done
[root@arch-test ssh]#

debbie10t wroteno doubt more related nasties will be pulled from the woodwork :twisted:

No doubt ..

Ref:
http://www.engadget.com/2014/09/25/what-is-the-shellshock/

ian darke

Yes -- it is a bash bug but unfortunately the impact of it is substa ntially more significant than this might at first lead you to believe. Anything that passes information to bash can be exploited and apparently that happens

Attack vectors including HTTP (i.e. custom user agent string), and DHCP (additional options), and SSH have already been demonstrated and there is already a large botnet forming worm-style from servers that are susceptible to the various attack vectors. Here is some more information re: DHCP

https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/

I (naively apparently) never would have thought that there would be a relationship between a DHCP server and the command shell.

I've done some light testing and so far things are looking good...

I'm assuming that this means that OpenVPN AS is not built using CGI?

debbie10t

ian darke wroteYes -- it is a bash bug

* Moved to off topic *

If the dev teams for either OpenVPN-CE or OpenVPN-AS feel the need to issue an official statement
then I am sure they will.

At this stage, I have been informed that OpenVPN-AS does not offer any attack vector, I presume
that means any calls which invoke bash are sanitized or rejected before they reach their target.

My understanding of OpenVPN-CE leaves me in no doubt that OpenVPN-CE is not vulnerable.

Services you have behind OpenVPN (any flavor) are the responsibility of the server admins.

Of course, this is a simple and very easy bug to expliot so it is difficult to say how the
bash dev team will choose to mitigate future possible epliots of this nature.

Simple answer; Keep your system upto date and follow reliable security bulletins.

The Johan

In the operation of the Access Server bash isn't used, so we're cool, and it doesn't affect our software directly. Still, the problem is so fundamental and so widespread, we advise EVERYONE to update their servers immediately to counter this problem. This should be done regardless of whatever software you're running; it's just common sense. So go and update your servers and keep them up to date. It's just the smart thing to do.

Rancor

Hi,

OpenVPN servers are vulnerable if they have some special configuration and an outdated bash version:

https://news.ycombinator.com/item?id=8385332
http://sprunge.us/BGjP

Source: https://github.com/mubix/shellshocker-pocs