Linux bash vulnerability

[suityou01]

Nope, still a user's problem. You shouldn't allow any application to open a shell and execute commands/scripts/etc from non-trusted sources, but still, approximately 90% of the posts on here are a troll aren't they? I noticed that a second version of Shellshock has come out

Every don't worry case I've read says as long as there is no sloppy configuration and companies haven't cut corners we should all be fine.

Not that reassuring really.

 

[darmstadt]

Bash patching...

 

[suityou01]

Bash patching...

You don't know it's related.

 

[Contreras]

You don't know it's related.

YOU USE TOO LONG TIME, PLEASE TRY AGAIN

 

[Stevie Wonder Boy]

You can do the exploit using headers. Not a User Problem.

 

[suityou01]

You can do the exploit using headers. Not a User Problem.

Aye. I think Darmie was being deliberately obtuse.

Next users crafting their own DHCP packets will be basic end user stuff

I understand IRC can also be used.

In other news, VOIP systems can also be exploited.

The attack vectors are not yet completely understood, the patches released so far have been ineffective and by now the hacking community has spread it's mucky seeds into every deep corner of the internet.

This is IT's 9/11.

I hate being right

 

[Sysman]

This is IT's 9/11.

I hate being right

Nah, we haven't had the conspiracy theories yet.

 

[suityou01]

Nah, we haven't had the conspiracy theories yet.

I only deal in cold hard fact

 

[Stevie Wonder Boy]

Aye. I think Darmie was being deliberately obtuse.

Next users crafting their own DHCP packets will be basic end user stuff

I understand IRC can also be used.

In other news, VOIP systems can also be exploited.

The attack vectors are not yet completely understood, the patches released so far have been ineffective and by now the hacking community has spread it's mucky seeds into every deep corner of the internet.

This is IT's 9/11.

I hate being right

Download a copy of fiddler2 - Not difficult.

Attack vector is any process that spawns a shell and sets environment variables using user input. So for SSH you could use a crafted username that would do the trick.

 

[suityou01]

Nah, we haven't had the conspiracy theories yet.

No nor I. But I can see the potential for this to trigger a global financial meltdown 2.0.