This reinforces the idea that security is a multifaceted
(or multilayer in the case of computing) experience. There
are vulnerabilities, there are exploits and then there are
cascading failures. Even if people aren't obsessive about
security they probably have at least 3 security layers working
for them (network, system and application level protections).
In my opinion this one is not as serious as the SSL bug and
even that was somewhat overdone though it was understandable
because SSL is client facing.
Bash in the modern world is not... (most notable use is
probably via SSH if that is the shell used.)
"That said, a system with Bash isn't always remotely
exploitable. The key, as Graham noted, is when that resource
"first sticks some Internet parameter in an environmental
variable, and then executes a Bash script.""
Unless you're doing something highly specialized most
programmers are not executing calls out to bash.
This is definitely skewed more towards situations where
someone can gain or already has bash access.
DHCP has also been brought up as an attack vector, as some
scripts may
pass unsanitized DHCP server output into an environment
variable.
That is mainly an issue for laptops visiting foreign networks,
but it
could be used to attack other hosts on the same subnet.
For things other than webservers I think the threat is
moderate, but
in general it is a bad idea to leave vulnerable software
around since
it could be used in a way you didn't anticipate. For example,
people
said heartbleed wasn't an issue for routers that didn't use
https, but
then it came up that some could use openssl as part of their
WPA2
authentication in a way that makes them vulnerable.
Bottom line is that software vulnerabilities occur when
software does
things that are unexpected. Such behavior can cause problems
at any
time, so it is almost always worth trying to fix. Of course,
priority
is a different matter. My phone came with a vulnerable bash
pre-installed, but I'm not in a rush to replace it as it isn't
the
default shell and I can't think of any likely exploit due to
the
nature of Android, and I'll just take the next OTA update
whenever it
gets sent out (probably within a few weeks). If something
changes
that assessment I can always build my own bash from source, or
I could
probably just delete it (I doubt anything needs to depend on
it).
--
Rich
___________________________________________________________________________
Philadelphia Linux Users Group --
http://www.phillylinux.org
Announcements -
http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion --
http://lists.phillylinux.org/mailman/listinfo/plug