What is the severity of the new bash exploit (shellshock)?

Question

I've been reading up about the remote bash exploit and was wondering how severe it is and if I should be worried, especially since a new exploit has been found after the patch release.

What does this mean for me as someone who uses Debian as my main desktop OS? Is there anything I should be aware of?

@Patrick - suggest waiting till Mr.Chazelas comes up with a canonical Q&A. — Deer Hunter, Sep 25 '14 at 13:08
Why? This is still a duplicate. And while yes, Chazelas is the finder, that doesn't mean he's the only one who understands the issue. — phemmer, Sep 25 '14 at 13:11
While Stéphane Chazelas can certainly explain well, I wold suggest taking this to the Security SE. — peterph, Sep 25 '14 at 13:27

score 10 · Accepted Answer · edited Jun 11 '20 at 12:04

TL;DR (aka executive summary)

Yes, you should be worried.
Yes, this is severe (giving total strangers potential complete control over your files and resources).

You should definitely upgrade your desktop AS WELL AS any servers.

(https://security.stackexchange.com/questions/68156/is-connecting-to-an-open-wifi-router-with-dhcp-in-linux-susceptible-to-shellshoc)

Your DHCP client uses dhclient-script which uses shell variables passed from the server. If there's a rogue/compromised router, it may pass modified domain-name variables with the exploit.

Credits: Stéphane Chazelas, Mark, Michal Zalewski

In addition, many desktops use OpenSSH, which is definitely vulnerable as per http://seclists.org/oss-sec/2014/q3/650 (although for logged-in users - aka rogue insiders on your network). According to the original reporter of the bug, Stéphane Chazelas, the OpenSSH vulnerability is about bypassing ssh ForcedCommand settings.

Please note, however, that a full fix for the issue is not available yet (http://seclists.org/oss-sec/2014/q3/679).

See https://access.redhat.com/articles/1200223 for possible workarounds. Debian hasn't published the upgrade yet, and I haven't had the time to find a relevant discussion on their site.

(NB: Second a suggestion by terdon; it would be very nice if Stéphane Chazelas could write down a canonical Q&A on Shellshock.)

The openssh vulnerability is about bypassing ForcedCommand (like for git deployment or port forwarding setups). If you have shell access to the remote server, it doesn't let you get more privileges. — Stéphane Chazelas, Sep 25 '14 at 11:34
How can this vulnerability be exploited against a desktop user? — DocSalvager, Sep 26 '14 at 23:59
@DocSalvager - if somebody compromises your router he may be able to attack your PC. — Deer Hunter, Sep 27 '14 at 03:56

What is the severity of the new bash exploit (shellshock)?

1 Answers1

TL;DR (aka executive summary)

You should definitely upgrade your desktop AS WELL AS any servers.