Groups > comp.os.linux.networking > #3095

Re: Are our WiFI routers and rooftop radios affected by the Bash Shellshock vulnerability?

From	Wildman <best_lay@yahoo.com>
Newsgroups	alt.internet.wireless, alt.os.linux, comp.os.linux.networking
Subject	Re: Are our WiFI routers and rooftop radios affected by the Bash Shellshock vulnerability?
Message-ID	<20140926221057.192f5947.best_lay@yahoo.com> (permalink)
References	(1 earlier) <cqlb2a9r2vt5s0nnhjf90j3noe4rro4vbv@4ax.com> <m04s7o$9uq$3@dont-email.me> <entb2alc3cv7h6k1d8e0r12sg7p534p3di@4ax.com> <20140926191052.76d69c3e.best_lay@yahoo.com> <m054l5$uiv$1@dont-email.me>
Organization	Wildman Productions
Date	2014-09-26 22:10 -0500

Cross-posted to 3 groups.

Show all headers | View raw

On Sat, 27 Sep 2014 01:41:58 +0000 (UTC)
William Unruh <unruh@invalid.ca> wrote:

> On 2014-09-27, Wildman <best_lay@yahoo.com> wrote:
> > On Fri, 26 Sep 2014 20:33:10 -0300
> > Shadow <Sh@dow.br> wrote:
> >
> >> On Fri, 26 Sep 2014 23:18:16 +0000 (UTC), William Unruh
> >> <unruh@invalid.ca> wrote:
> >> 
> >> >On 2014-09-26, Shadow <Sh@dow.br> wrote:
> >> >> On Fri, 26 Sep 2014 05:44:50 +0000 (UTC), Ger Robertson
> >> >><something@something.invalid> wrote:
> >> >>
> >> >>>Anyone know how we can tell if our WiFI routers and rooftop
> >> >>>radios are affected by the Bash Shellshock vulnerability?
> >> >>
> >> >> 	Telnet (or Putty) into it and
> >> >> 	sh
> >> >> 	will tell you what shell it runs.
> >> >> 	[]'s
> >> >
> >> >No it will tell you what shell it runs as a replacement for sh. It
> >> >may have many shells installed. 
> >> >And once you have telneted in, you already have shell access so do
> >> >not need shell access. 
> >> >The question is whether there are any externally listening
> >> >programs which use bash and which can be fed "carefully crafted"
> >> >environment variables from outside. 
> >> 
> >> #sh
> >> 
> >> BusyBox v1.00 (2012.02.06-00:34+0000) Built-in shell (msh)
> >> Enter 'help' for a list of built-in commands.
> >> 
> >> #cat /etc/services
> >> 
> >> 	Aw, c'mon, it's a start.
> >> 	[]'s
> >
> > To find out what the default shell is, enter this...
> >   echo $SHELL
> 
> Different default. This is the default for that particular user-- the
> shell that is opened up on a terminal when the user logs in. The
> default I was talking about is the default that the system uses in
> general- it is usually called sh, but most systems have /bin/sh
> pointing to some other shell which also has the same commands as the
> classic sh shell (such as bash). Writers expect sh to comply with
> certain standards so for example /bin/tcsh would not be a good thing
> for /bin/sh to point to because thestructure of tcsh is very
> different from the old sh.

On a Linux/Unix system that is true.  I don't think routers
support multiple users or do they?

> > If it is bash and there are other shells installed, you can
> > change the default shell.
> >   chsh -s /bin/dash
> > or
> >   chsh -s /bin/sh
> > or whatever.
> 
> That will change your own particular shell that is brought up when you
> log in. 

If routers support only one user, that would not be an issue.
Even so, it is possible to change the default shell for all
users.

> Actually the latter will probably give you bash anyway, since
> /bin/sh is often a link to /bin/bash. 

On my system, SolydX, sh points to dash.  The same is true
for Mint, Ubuntu and MX-14.  Don't know about any others.

-- 
<Wildman> GNU/Linux user #557453
The cow died so I don't need your bull!

Thread

csiph-web