Re: [PLUG] 'Shellshock' Bug Spells Trouble for Web Security

[Rich Freeman <r-plug@thefreemanclan.net>]

On Fri, Sep 26, 2014 at 11:09 AM, Fred Stluka <fred@bristle.com> wrote:
>
> But only if they try to access a malicious DHCP server to get
> assigned an IP address, right?  My web server should never
> be able to be tricked into trying to use a remote DHCP server.
> It would have to be that the local DHCP server it already uses
> has gotten infected, right?
>

DHCP clients don't choose servers.  They send a broadcast and accept
whatever replies they get.  Of course, only a host on the local subnet
can respond to a broadcast.

So, if somebody can get onto the same subnet as your webserver, and
its DHCP client is vulnerable (implementation-specific), then it could
potentially be compromised.

Again, it is more of a risk for things like laptops that frequent
foreign networks.  I suspect systemd-networkd is immune since it tends
to avoid using bash for anything, but I am not certain on that.  They
were just bragging about how their DHCP process executes in
milliseconds, and I can't imagine that they're using dhclient/etc to
accomplish that.

--
Rich
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug