[B! ShellShock] rryuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

rryu id:rryu

ShellShockã«é–¢ã™ã‚‹rryuã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (6)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

qmail + Shellshock: ã©ã•ã«ã£ã
2014å¹´9æœˆ24æ—¥(æ°´) â– SSDP _ IW2014 DNS DAYã®ãƒ—ãƒã‚°ãƒ©ãƒ ãŒç™ºè¡¨ã•ã‚Œã¦ã¾ã—ãŸã€‚ä»Šå¹´ã‚‚å–‹ã‚Šã¾ã™ã€‚ãŠé¡Œã¯ IP53Bã€‚ã‚ˆã‚ã—ãã€‚ _ å†…å®¹ã¯ IP53B ã«é–¢é€£ã™ã‚‹ã‚“ã ã‘ã©ã€æŒã¡æ™‚é–“ãŒã‚ã¾ã‚Šé•·ããªã„ã®ã¨ã€ã‚ãã¾ã§ "DNS" DAY ã¨ã„ã†ã“ã¨ã§ãƒ†ãƒ¼ãƒžãŒããã‚ãªã„ã‹ã‚‚ã¨ã„ã†ã“ã¨ã§ã€å½“æ—¥ã«å–‹ã‚‰ãªã„ã‹ã‚‚ã—ã‚Œãªã„ãƒã‚¿ã‚’ä»Šã®ã†ã¡ã«æŠ•ä¸‹ã—ã¦ã¿ã‚‹(ä½™è£•ãŒã‚ã‚Œã°å–‹ã‚ŠãŸã„)ã€‚ _ SSDPã¨ã„ã†ãƒ—ãƒãƒˆã‚³ãƒ«ãŒã‚ã‚‹ã§ã™ã‚ˆã€‚UPnP ã§ä½¿ã‚ã‚Œã‚‹ã‚‚ã®ã€‚1900/udpã€‚ã¯ã„ã€UDP ã§ã™ã€‚amp æ”»æ’ƒã®è¸ã¿å°ã«åˆ©ç”¨å¯èƒ½ã€‚ å¢—å¹…çŽ‡ã¯ãŠã‚ˆã30å€ãã‚‰ã„ã€‚è¸ã¿å°ã«ãªã‚Šã†ã‚‹ã‚ªãƒ¼ãƒ—ãƒ³ãª SSDP ã‚µãƒ¼ãƒã¯ã€ å…¨ä¸–ç•Œã§1700ä¸‡å°ã€å›½å†…ã«65ä¸‡å°ã‚‚å˜åœ¨ã—ã¦ã„ã‚‹æ¨¡æ§˜ã€‚ ã‚ªãƒ¼ãƒ—ãƒ³ãƒªã‚¾ãƒ«ãƒã‚ˆã‚Šã‚‚å¤šã„ã€‚ _ ã•ã‚‰ã«æ‚ªã„ã“ã¨ã«ã€ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®è¤‡æ•°ã® SSDP å®Ÿè£…ã«ã¯ã€å¤–éƒ¨ã‹ã‚‰ä»»æ„ã‚³ãƒ¼ãƒ‰ã‚’æ³¨å…¥ã§ãã‚‹ è„†å¼±æ€§ã®
rryu 2014/09/30
Mac OS Xã®DHCPã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆã¯ã‚·ã‚§ãƒ«ã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’å‘¼ã°ãªã„ã‚¿ã‚¤ãƒ—ãªã®ã§å¤§ä¸ˆå¤«ã¨ã€‚

ShellShock

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
ãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«å†…ã®ã‚µãƒ¼ãƒã«å¯¾ã™ã‚‹Shellshockã‚’åˆ©ç”¨ã—ãŸæ”»æ’ƒ - è‘‰ã£ã±æ—¥è¨˜
2014-09-27: è©²å½“ã‚µã‚¤ãƒˆä¸Šã«XSSãŒãªãã¦ã‚‚æ”»æ’ƒå¯èƒ½ã§ã‚ã‚‹ã“ã¨ãŒ id:mayuki ã•ã‚“ã®ã‚³ãƒ¡ãƒ³ãƒˆã§åˆ¤æ˜Žã—ã¾ã—ãŸã®ã§å…¨é¢çš„ã«æ›¸ãç›´ã—ã¾ã—ãŸã€‚ãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«å†…ã§ã‚ã£ã¦ã‚‚æ”»æ’ƒè€…ã¯ãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«å†…ã®Shellshockæ”»æ’ƒãŒé€šç”¨ã™ã‚‹CGIã®URLãŒã‚ã‹ã£ã¦ã„ã‚‹ã ã‘ã§æ”»æ’ƒå¯èƒ½ã§ã™ã®ã§æ—©æ€¥ã«å¯¾å¿œãŒå¿…è¦ã§ã™ï¼ä¼šç¤¾ã®ãƒ–ãƒã‚°ã«ã‚‚æ›¸ã„ã¦ã¾ã™ãŒã€ãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«å†…ã«ç½®ã„ã¦ã‚ã‚‹ã‚µãƒ¼ãƒã§æ”»æ’ƒè€…ãŒç›´æŽ¥ã‚¢ã‚¯ã‚»ã‚¹ã§ããªã„ã‹ã‚‰ã¨ã„ã£ã¦bashã®æ›´æ–°ã‚’æ€ ã£ã¦ã„ã‚‹ã¨ã€æ¡ä»¶ã«ã‚ˆã£ã¦ã¯æ”»æ’ƒãŒå¯èƒ½ã¨ãªã‚Šã¾ã™ã€‚ æ¡ä»¶ã¨ã—ã¦ã¯ã€ ãã®ã‚µãƒ¼ãƒã«ã¯ã‚·ã‚§ãƒ«ã‚’çµŒç”±ã—ã¦å¤–éƒ¨ã‚³ãƒžãƒ³ãƒ‰ã‚’èµ·å‹•ã™ã‚‹CGIç‰ãŒå‹•ã„ã¦ã„ã‚‹(é€šå¸¸ã®Shellshockã®æ”»æ’ƒã¨åŒæ¡ä»¶) æ”»æ’ƒè€…ãŒãã®URLã‚’äº‹å‰ã«çŸ¥ã£ã¦ã„ã‚‹(ã‚ã‚‹ã„ã¯æŽ¨æ¸¬å¯èƒ½) ã¨ãªã‚Šã¾ã™ã€‚ æ”»æ’ƒè€…ã¯ã€ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’ç½ URLã¸èª˜å°Žã—ã€ä»¥ä¸‹ã®ã‚ˆã†ãªJavaScriptã‚’ç½ ãƒšãƒ¼ã‚¸ä¸Šã§å‹•ã‹ã—ã€æ”»æ’ƒå¯¾è±¡ã®W
rryu 2014/09/30
XHRã®å¿œç”ãŒèªã‚ãªãã¦ã‚‚/dev/tcpã§é€ã‚Šã¤ã‘ã‚Œã°ã„ã„ã‹ã‚‰äº‹å®Ÿä¸Šä½•ã§ã‚‚ã§ããã†ã€‚

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ShellShock
ãƒªãƒ³ã‚¯
https://jp.techcrunch.com/2014/09/30/20140929apple-just-patched-the-shellshock-bug-in-os-x/
rryu 2014/09/30
é€šå¸¸ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã¨ã—ã¦ã ã¨ã“ã®é€Ÿåº¦ã§å‡ºã›ãªã„ã‹ã‚‰ãªã‚“ã ã‚ã†ã‘ã©ã€ã‚‚ã†å°‘ã—åˆ†ã‹ã‚Šã‚„ã™ã„ã¨ã“ã‚ã«ç½®ã‘ãªã‹ã£ãŸã®ã ã‚ã†ã‹ã€‚

shellshock

OS X

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
bash ã®è„†å¼±æ€§ "Shell Shock" ã®ã‚ã£ã¡ã‚ƒç´°ã‹ã„è©± (CVE-2014-6271) - ã‚‚ã‚ãš blog
â€»(2014/10/1 è¿½è¨˜) è„†å¼±æ€§ã®ç•ªå·ã‚’èª¤ã£ã¦ CVE-2014-6721 ã¨è¡¨è¨˜ã—ã¦ã—ã¾ã£ã¦ã„ã¾ã—ãŸ æ£ã—ãã¯ "CVE-2014-6271" ã§ã™ å¤±ç¤¼è‡´ã—ã¾ã—ãŸ â€»(2014/10/7 è¿½è¨˜) 2014/10/7 14:00æ™‚ç‚¹ã§ Shell Shock ã¸ã®ä¿®æ£ãƒ‘ãƒƒãƒã¯6å€‹ å…¬é–‹ã•ã‚Œã¦ã„ã¾ã™ æ—¢ã«å¯¾å¿œæ¸ˆã¿ã®ã‚·ã‚¹ãƒ†ãƒ ã§ã‚‚ãƒ‘ãƒƒãƒã®æ¼ã‚ŒãŒãªã„ã‹æ³¨æ„ã—ã¦ãã ã•ã„ ã‚·ã‚§ãƒ«ã«è„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸã‚‰ã—ã„ã§ã™ ã“ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’å®Ÿè¡Œã™ã‚‹ã¨è„†å¼±æ€§ãŒã‚ã‚‹ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‹ã®ãƒã‚§ãƒƒã‚¯ãŒã§ãã‚‹ã‚ˆã†ã§ã™ $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" ä»¥ä¸‹ã®ã‚ˆã†ã«è¡¨ç¤ºã•ã‚ŒãŸã‚‰ã‚¢ã‚¦ãƒˆã§ã™ vulnerable this is a test ã©ã†ã‚„ã‚‰ã€ã“ã®ã‚³ãƒžãƒ³ãƒ‰ãŒæ£å¸¸ã«å®Ÿè¡Œã§ãã‚‹ã¨ã„ã†ã®ãŒã“ã®è„†å¼±æ€§ã®æ£ä½“ã‚‰ã—ãã€ echo vuln
rryu 2014/09/29
é–¢æ•°å®šç¾©æ–‡ã‚’æ™®é€šã«å®Ÿè¡Œã—ã¦é–¢æ•°ã‚’å®šç¾©ã—ã¦ã„ãŸã‚‰ã€é–¢æ•°å®šç¾©ä»¥å¤–ã®ã‚‚ã®ã‚’æ··ãœã‚‰ã‚Œã‚‹ãƒ‘ã‚¿ãƒ¼ãƒ³ãŒã‚ã£ã¦æ»äº¡ã¨ã¯ã€‚

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ShellShock

bash
ãƒªãƒ³ã‚¯
Phusion Passenger author here. See https://github.com/phusion/passenger/issues/1... | Hacker News
Phusion Passenger author here. See https://github.com/phusion/passenger/issues/1286 for details.In short: Phusion Passenger sometimes spawns application processes (e.g. during startup). This spawning happens through bash. Some environment variables are set according to certain HTTP headers' values. We've been hoping the entire day that bash is going to be fixed "any time now", but the fix still is
rryu 2014/09/28
PassengerLoadShellEnvvarsãŒOFFã‹ãƒã‚°ã‚¤ãƒ³ã‚·ã‚§ãƒ«ãŒbashã§ãªã‘ã‚Œã°å¤§ä¸ˆå¤«ã‚‰ã—ã„ã€‚

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ShellShock

passenger

Rails
ãƒªãƒ³ã‚¯
ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã«ãŠã‘ã‚‹Bashè„†å¼±æ€§ã®å³æ»æ¡ä»¶ #ShellShock - ã‚ã‚‚ãŠãã°
æ¡ä»¶1. /bin/shã®å®Ÿä½“ãŒbashã®ãƒ‡ã‚£ã‚¹ãƒˆãƒªãƒ“ãƒ¥ãƒ¼ã‚·ãƒ§ãƒ³ RHEL CentOS Scientific Linux Fedora Amazon Linux openSUSE Arch Linux (è‡ªã‚‰è¨å®šã—ãŸå ´åˆ: Debian, Ubuntu) æ¡ä»¶2. å‹•ä½œç’°å¢ƒ CGI (ãƒ¬ãƒ³ã‚¿ãƒ«ã‚µãƒ¼ãƒã§ã‚ã‚ŠãŒã¡ãªCGIãƒ¢ãƒ¼ãƒ‰ã®PHPç‰ã‚‚å«ã‚€) Passenger(Ruby) æ¡ä»¶3. ãƒ—ãƒã‚°ãƒ©ãƒ å†…å®¹ Passengerã¯å…¨æ»äº¡ *1 systemã‚„ `command`ã€ '| /usr/lib/sendmail' ãªã©ã§å¤–éƒ¨ã‚³ãƒžãƒ³ãƒ‰å®Ÿè¡Œ *2 PHPã®mailã‚„mb_send_mailã€ãã®ä»–ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ç‰ã‚’ä»‹ã—ãŸãƒ¡ãƒ¼ãƒ«é€ä¿¡ *3 ä»¥ä¸‹ã¯æ¡ä»¶1ãŒä¸è¦ æ˜Žç¤ºçš„ã«bashã‚’å‘¼ã¶ å…ˆé ã§ #!/bin/bash ã‚„ #!/usr/bin/env bash ã—ã¦ã„ã‚‹ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’å®Ÿè¡Œ (rbenv
rryu 2014/09/28
PassengerLoadShellEnvvarsãŒONã ã¨ãƒ¯ãƒ¼ã‚«ãƒ¼ã‚’ã‚·ã‚§ãƒ«çµŒç”±ã§èµ·å‹•ã™ã‚‹ã®ã§å³æ»ã¨ã„ã†ã“ã¨ã‚‰ã—ã„ã€‚ãã—ã¦ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã¯ONâ€¦â€¦

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

ShellShock

bash

rails
ãƒªãƒ³ã‚¯
1