patched-bash-4.3 for CVE-2014-6271patched-bash-4.3
================
patched-bash-4.3 for CVE-2014-6271
This is just bash 4.3 , pulled from the gnu website, and patched with the patches available on 9/26/2014, including the pkgsrc functionality changes that just disable the silly "execute functions in env variables" altogether.
The patches are also included here, but I've already applied them to the sourcecode (for those unfamiliar with the ```patch``` command)
Don't use this, if you don't know and trust me. Build it yourself.
I'm putting this on github so I can point friends and co-workers here.
#### For hotpatching this in a SmartOS zone (like in JPC):
- clone this repo
``` git clone https://github.com/ryancnelson/patched-bash-4.3 ```
- ```cd bash-4.3```
- ```make clean ; ./configure ; make ; make install ```
- look at
```
/usr/local/bin/bash --version
GNU bash, version 4.3.25(1)-release (i386-pc-solaris2.11)
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
```
- mount this file, using the lofs mount trick , ON TOP of /usr/bin/bash :
- you may need to reboot to kill off any currently running bash shells
- after reboot, log back in, and run ``` exec /bin/sh ``` to confirm you're not using bash at the moment.
- ``` ps -ef | grep bash ``` should return nothing.
- then, mount /usr/local/bin/bash over /usr/bin/bash with: ```mount -O -F lofs /usr/local/bin/bash /usr/bin/bash ```
- this lofs mount is not permanent. re-do after reboots, or wait for a patched platform image.
- confirm that ```/usr/bin/bash --version ``` returns the new 4.3 version you expect after the ```lofs mount``` command
### for extra credit:
If you're interested, in SmartOS, in watching your system to see when ```bash``` is executed, you can, using DTrace:
run this at your command line:
```
dtrace -n 'proc:::exec-success /basename(execname)=="bash"/ {printf("%d executed %s\n", ppid, execname);}'
```
... then, log in again, or spawn some bash shells. You should see lines like:
```
CPU ID FUNCTION:NAME
1 11422 exec_common:exec-success 91178 executed bash
```
... this'll let you know whether your application(s) are forking bash under the covers, unbeknownst to you, as part of their normal operations, and whether you're exposed to external intruders being able to spawn bash and exploit it, remotely.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view