2

I've been reading about the CVE-2014-6271 bug on lots of pages, but I'm still not able to understand how exactly is it possible to exploit it over ssh.

From all I've read, I couldn't find an example that executes a piece of code without being authenticated. I'm just trying to understand the bug better, no hacking involved.

As per https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/

An attacker can provide specially-crafted environment variables containing arbitrary commands that will be executed on vulnerable systems under certain conditions. The new issue has been assigned CVE-2014-7169.

Improve this question
5
  • some good info here: access.redhat.com/articles/1200223
    – glenn jackman
    Sep 25, 2014 at 18:26
  • I read that one and the link in the article. They do both describe the diagnostic, details about the bug and how to solve it. My question is how do I run an arbitrary piece of code on another machine via ssh without authorization, as many articles suggest that the exploit makes this possible
    – Mihai Bujanca
    Sep 25, 2014 at 18:28
  • "cracking" is almost certainly considered off topic here. Google search topics such as buffer overflows ;) The topic is moderately complex and not really conducive to this question / answer format.
    – Panther
    Sep 25, 2014 at 18:34
  • Also , when reading "certain conditions" , those conditions may not be know as injecting code is not a part of the original design. The point is that it is possible to run arbitrary code.
    – Panther
    Sep 25, 2014 at 18:37
  • Ok, can anyone provide an example of some conditions that would allow an attacker to provide specially-crafted variables that contain arbitrary commands? And an example of this kind of variables?
    – Mihai Bujanca
    Sep 26, 2014 at 11:37

2 Answers 2

Reset to default
1

The bug occurs when bash gets executed with a specially crafted environment variable.

Remote exploitation over SSH is only possible when bash is executed. When the ForceCommand SSH option is in use, that command always gets executed using the login shell of the authenticated user (see the manual page of sshd_config).

Vulnerable configurations include public git services which normally restrict you to just running git commands. With this bug, you would be able to execute shell commands, bypassing the ForceCommand restriction. For a git daemon service, this could mean that you can access all repositories owned by the system user (bypassing access restrictions imposed by, say, gitolite).

Improve this answer
1

You cannot circumvent authentication by exploiting this bug.

But SSH allows you to restrict what commands a user can run, e.g. by using ForceCommand in sshd_config. By exploiting this bug a user can circumvent this restriction and run any command she/he wants.

Improve this answer
2
  • Not directly, but if one has shell access, privilege escalation can follow very closely. Also one does not have to have root access to cause problems.
    – Panther
    Sep 25, 2014 at 18:39
  • So that would be installing stuff without being root, for example, right?
    – Mihai Bujanca
    Sep 26, 2014 at 11:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .