Groups > comp.os.linux.networking > #3080 > unrolled thread

Are our WiFI routers and rooftop radios affected by the Bash Shellshock vulnerability?

Started by	Ger Robertson <something@something.invalid>
First post	2014-09-26 05:44 +0000
Last post	2014-09-27 02:23 -0600
Articles	20 on this page of 26 — 13 participants

Back to article view | Back to comp.os.linux.networking

Page 1 of 2 [1] 2 Next page →

#3080 — Are our WiFI routers and rooftop radios affected by the Bash Shellshock vulnerability?

From	Ger Robertson <something@something.invalid>
Date	2014-09-26 05:44 +0000
Subject	Are our WiFI routers and rooftop radios affected by the Bash Shellshock vulnerability?
Message-ID	<m02ugi$rqe$1@news.albasani.net>

Anyone know how we can tell if our WiFI routers and rooftop radios are 
affected by the Bash Shellshock vulnerability?

[toc] | [next] | [standalone]

#3081

From	Chris Ahlstrom <OFeem1987@teleworm.us>
Date	2014-09-26 05:53 -0400
Message-ID	<m03d32$g26$1@dont-email.me>
In reply to	#3080

Ger Robertson wrote this copyrighted missive and expects royalties:

> Anyone know how we can tell if our WiFI routers and rooftop radios are 
> affected by the Bash Shellshock vulnerability?

Shell into it and see!

-- 
In Lowes Crossroads, Delaware, it is a violation of local law for any
pilot or passenger to carry an ice cream cone in their pocket while
either flying or waiting to board a plane.

[toc] | [prev] | [next] | [standalone]

#3082

From	John Hasler <jhasler@newsguy.com>
Date	2014-09-26 07:51 -0500
Message-ID	<87vboa8s07.fsf@thumper.dhh.gt.org>
In reply to	#3080

> Anyone know how we can tell if our WiFI routers and rooftop radios are
> affected by the Bash Shellshock vulnerability?

They almost certainly aren't.  Bash is unlikely to be installed on
embedded systems: too large.  They probably use Busybox.  Besides, if
anyone on the WAN can connect to your router at all it's already broken.
Of course, if you are running the manufacturer's firmware it probably
has a dozen gaping holes built in anyway...
-- 
John Hasler 
jhasler@newsguy.com
Dancing Horse Hill
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]

#3083

From	Caver1 <Caver1@inthemud.org>
Date	2014-09-26 12:26 -0400
Message-ID	<m0443a$105$1@dont-email.me>
In reply to	#3082

On 09/26/2014 08:51 AM, John Hasler wrote:
>> Anyone know how we can tell if our WiFI routers and rooftop radios are
>> affected by the Bash Shellshock vulnerability?
> 
> They almost certainly aren't.  Bash is unlikely to be installed on
> embedded systems: too large.  They probably use Busybox.  Besides, if
> anyone on the WAN can connect to your router at all it's already broken.
> Of course, if you are running the manufacturer's firmware it probably
> has a dozen gaping holes built in anyway...
> 

Ubuntu with bash scripts is used for many embedded appliances and they
are vulnerable.

-- 
Caver1

[toc] | [prev] | [next] | [standalone]

#3084

From	Caver1 <Caver1@inthemud.org>
Date	2014-09-26 12:40 -0400
Message-ID	<m044t3$437$1@dont-email.me>
In reply to	#3083

On 09/26/2014 12:26 PM, Caver1 wrote:
> On 09/26/2014 08:51 AM, John Hasler wrote:
>>> Anyone know how we can tell if our WiFI routers and rooftop radios are
>>> affected by the Bash Shellshock vulnerability?
>>
>> They almost certainly aren't.  Bash is unlikely to be installed on
>> embedded systems: too large.  They probably use Busybox.  Besides, if
>> anyone on the WAN can connect to your router at all it's already broken.
>> Of course, if you are running the manufacturer's firmware it probably
>> has a dozen gaping holes built in anyway...
>>
> 
> Ubuntu with bash scripts is used for many embedded appliances and they
> are vulnerable.
> 

Here's a link,

https://gigaom.com/2014/09/25/the-critical-shellshock-flaw-affects-many-linux-and-apple-systems-heres-what-you-need-to-know/

-- 
Caver1

[toc] | [prev] | [next] | [standalone]

#3085

From	Java Jive <java@evij.com.invalid>
Date	2014-09-26 20:00 +0100
Message-ID	<2mdb2a9vqutlk93g6klr8lf1ttm9ra40n4@4ax.com>
In reply to	#3084

"The critical Shellshock flaw affects many Linux and Apple systems —
here’s what you need to know"

But actually tells you nothing really useful at all, just gives as
many scary quotes from as many security experts as he could find when
writing up his useless FUD.

If he was really concerned, he would have found out enough about how
best to fix it temporarily until security updates come along.

On Fri, 26 Sep 2014 12:40:03 -0400, Caver1 <Caver1@inthemud.org>
wrote:
> 
> Here's a link,
> 
> https://gigaom.com/2014/09/25/the-critical-shellshock-flaw-affects-many-linux-and-apple-systems-heres-what-you-need-to-know/
-- 
=========================================================
Please always reply to ng as the email in this post's
header does not exist.  Or use a contact address at:
	http://www.macfh.co.uk/JavaJive/JavaJive.html
	http://www.macfh.co.uk/Macfarlane/Macfarlane.html

[toc] | [prev] | [next] | [standalone]

#3102

From	Caver1 <Caver1@inthemud.org>
Date	2014-09-27 18:52 -0400
Message-ID	<m07f2j$4lr$1@dont-email.me>
In reply to	#3085

On 09/26/2014 03:00 PM, Java Jive wrote:
> "The critical Shellshock flaw affects many Linux and Apple systems —
> here’s what you need to know"
> 
> But actually tells you nothing really useful at all, just gives as
> many scary quotes from as many security experts as he could find when
> writing up his useless FUD.
> 
> If he was really concerned, he would have found out enough about how
> best to fix it temporarily until security updates come along.
> 
> On Fri, 26 Sep 2014 12:40:03 -0400, Caver1 <Caver1@inthemud.org>
> wrote:
>>
>> Here's a link,
>>
>> https://gigaom.com/2014/09/25/the-critical-shellshock-flaw-affects-many-linux-and-apple-systems-heres-what-you-need-to-know/


I agree just pointed this out to show that routers could be affected.

-- 
Caver1

[toc] | [prev] | [next] | [standalone]

#3110

From	alexd <troffasky@hotmail.com>
Date	2014-10-03 20:53 +0100
Message-ID	<m0muro$a3c$2@dont-email.me>
In reply to	#3083

Caver1 (for it is he) wrote:

> Ubuntu with bash scripts is used for many embedded appliances and they
> are vulnerable.

How many embedded appliances are running Ubuntu, again?

-- 
 <http://ale.cx/> (AIM:troffasky) (UnSoEsNpEaTm@ale.cx)
 20:52:18 up 33 days, 11:08,  7 users,  load average: 0.83, 0.66, 0.56
 Any sufficiently advanced incompetence is indistinguishable 
 from malice

[toc] | [prev] | [next] | [standalone]

#3111

From	Thad Floryan <thad@thadlabs.com>
Date	2014-10-03 13:33 -0700
Message-ID	<542F081B.3070009@thadlabs.com>
In reply to	#3110

On 10/3/2014 12:53 PM, alexd wrote:
> Caver1 (for it is he) wrote:
> 
>> Ubuntu with bash scripts is used for many embedded appliances and they
>> are vulnerable.
> 
> How many embedded appliances are running Ubuntu, again?

Depends on what one will accept as an "embedded" system;
the SheevaPlug definitely qualifies as embedded.

My Sheevaplug servers are fist-sized and the GuruPlug runs
Debian.  Quick example (noting the short uptime is due to
having had to replace a UPS battery recently) noting that
root is the only login on such servers:

root@lanserv1:~# date
Fri Oct  3 13:14:40 PDT 2014
root@lanserv1:~# uptime
 13:14:42 up 55 days, 22:37,  1 user,  load average: 0.19, 0.15, 0.12
root@lanserv1:~# cat /etc/issue
Ubuntu 9.04 \n \l

root@lanserv1:~# ping thadlabs.com      # 12 miles away in Milpitas CA
PING thadlabs.com (192.220.75.50) 56(84) bytes of data.
64 bytes from thadlabs.com (192.220.75.50): icmp_seq=1 ttl=53 time=15.7 ms
64 bytes from thadlabs.com (192.220.75.50): icmp_seq=2 ttl=53 time=14.3 ms
64 bytes from thadlabs.com (192.220.75.50): icmp_seq=3 ttl=53 time=15.6 ms
64 bytes from thadlabs.com (192.220.75.50): icmp_seq=4 ttl=53 time=16.3 ms

--- thadlabs.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3000ms
rtt min/avg/max/mdev = 14.331/15.527/16.375/0.749 ms
root@lanserv1:~# bash --version
GNU bash, version 3.2.48(1)-release (arm-unknown-linux-gnueabi)
Copyright (C) 2007 Free Software Foundation, Inc.
root@lanserv1:~# uname -a
Linux lanserv1 2.6.22.18 #1 Thu Mar 19 14:46:22 IST 2009 armv5tejl GNU/Linux
root@lanserv1:~#

Note the sizes of the SheevaPlugs and GuruPlug which have been running
here since 2009:

    http://thadlabs.com/PIX/SheevaPlug_first.jpg
    http://thadlabs.com/PIX/SheevaPlug_underside.jpg
    http://thadlabs.com/PIX/SheevaPlug_labelled.jpg
    http://thadlabs.com/PIX/SheevaPlug_Webmin.jpg
    http://thadlabs.com/PIX/SheevaPlug_GuruPlug.jpg
    http://thadlabs.com/PIX/SheevaPlug_CPU_card_top.jpg
    http://thadlabs.com/PIX/SheevaPlug_CPU_card_bottom.jpg

These consume only 4 to 5 Watts power per a Kill-A-Watt device
and they have GiGE ports to serve my LAN (DHCP, DNS, and more)
which is all gigabit:

    http://thadlabs.com/PIX/ThadLABS_network_demarc.jpg
    http://thadlabs.com/FILES/ThadLABS_network_demarc.txt

Thad

[toc] | [prev] | [next] | [standalone]

#3112

From	John Hasler <jhasler@newsguy.com>
Date	2014-10-03 15:51 -0500
Message-ID	<87d2a83mia.fsf@thumper.dhh.gt.org>
In reply to	#3111

Thad Floryan writes:
> Depends on what one will accept as an "embedded" system; the
> SheevaPlug definitely qualifies as embedded.

No it doesn't.  It qualifies as a headless server.  An embedded system
is embedded in another machine such as a car or a radio.
-- 
John Hasler 
jhasler@newsguy.com
Dancing Horse Hill
Elmwood, WI USA

[toc] | [prev] | [next] | [standalone]

#3114

From	Thad Floryan <thad@thadlabs.com>
Date	2014-10-03 21:01 -0700
Message-ID	<m0nrer$emj$1@dont-email.me>
In reply to	#3112

On 10/3/2014 1:51 PM, John Hasler wrote:
> Thad Floryan writes:
>> Depends on what one will accept as an "embedded" system; the
>> SheevaPlug definitely qualifies as embedded.
> 
> No it doesn't.  It qualifies as a headless server.  An embedded system
> is embedded in another machine such as a car or a radio.

OK, I'll accept that, and this confirms it:

    http://en.wikipedia.org/wiki/Embedded_system

Thanks!  Learn something new every day.  :-)

Thad

[toc] | [prev] | [next] | [standalone]

#3086

From	Shadow <Sh@dow.br>
Date	2014-09-26 18:16 -0300
Message-ID	<cqlb2a9r2vt5s0nnhjf90j3noe4rro4vbv@4ax.com>
In reply to	#3080

On Fri, 26 Sep 2014 05:44:50 +0000 (UTC), Ger Robertson
<something@something.invalid> wrote:

>Anyone know how we can tell if our WiFI routers and rooftop radios are 
>affected by the Bash Shellshock vulnerability?

	Telnet (or Putty) into it and
	sh
	will tell you what shell it runs.
	[]'s
-- 
Don't be evil - Google 2004
We have a new policy  - Google 2012

[toc] | [prev] | [next] | [standalone]

#3088

From	William Unruh <unruh@invalid.ca>
Date	2014-09-26 23:18 +0000
Message-ID	<m04s7o$9uq$3@dont-email.me>
In reply to	#3086

On 2014-09-26, Shadow <Sh@dow.br> wrote:
> On Fri, 26 Sep 2014 05:44:50 +0000 (UTC), Ger Robertson
><something@something.invalid> wrote:
>
>>Anyone know how we can tell if our WiFI routers and rooftop radios are 
>>affected by the Bash Shellshock vulnerability?
>
> 	Telnet (or Putty) into it and
> 	sh
> 	will tell you what shell it runs.
> 	[]'s

No it will tell you what shell it runs as a replacement for sh. It may
have many shells installed. 
And once you have telneted in, you already have shell access so do not
need shell access. 
The question is whether there are any externally listening programs
which use bash and which can be fed "carefully crafted" environment
variables from outside.

[toc] | [prev] | [next] | [standalone]

#3089

From	Shadow <Sh@dow.br>
Date	2014-09-26 20:33 -0300
Message-ID	<entb2alc3cv7h6k1d8e0r12sg7p534p3di@4ax.com>
In reply to	#3088

On Fri, 26 Sep 2014 23:18:16 +0000 (UTC), William Unruh
<unruh@invalid.ca> wrote:

>On 2014-09-26, Shadow <Sh@dow.br> wrote:
>> On Fri, 26 Sep 2014 05:44:50 +0000 (UTC), Ger Robertson
>><something@something.invalid> wrote:
>>
>>>Anyone know how we can tell if our WiFI routers and rooftop radios are 
>>>affected by the Bash Shellshock vulnerability?
>>
>> 	Telnet (or Putty) into it and
>> 	sh
>> 	will tell you what shell it runs.
>> 	[]'s
>
>No it will tell you what shell it runs as a replacement for sh. It may
>have many shells installed. 
>And once you have telneted in, you already have shell access so do not
>need shell access. 
>The question is whether there are any externally listening programs
>which use bash and which can be fed "carefully crafted" environment
>variables from outside. 

#sh

BusyBox v1.00 (2012.02.06-00:34+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

#cat /etc/services

	Aw, c'mon, it's a start.
	[]'s


	
-- 
Don't be evil - Google 2004
We have a new policy  - Google 2012

[toc] | [prev] | [next] | [standalone]

#3091

From	Wildman <best_lay@yahoo.com>
Date	2014-09-26 19:10 -0500
Message-ID	<20140926191052.76d69c3e.best_lay@yahoo.com>
In reply to	#3089

On Fri, 26 Sep 2014 20:33:10 -0300
Shadow <Sh@dow.br> wrote:

> On Fri, 26 Sep 2014 23:18:16 +0000 (UTC), William Unruh
> <unruh@invalid.ca> wrote:
> 
> >On 2014-09-26, Shadow <Sh@dow.br> wrote:
> >> On Fri, 26 Sep 2014 05:44:50 +0000 (UTC), Ger Robertson
> >><something@something.invalid> wrote:
> >>
> >>>Anyone know how we can tell if our WiFI routers and rooftop radios
> >>>are affected by the Bash Shellshock vulnerability?
> >>
> >> 	Telnet (or Putty) into it and
> >> 	sh
> >> 	will tell you what shell it runs.
> >> 	[]'s
> >
> >No it will tell you what shell it runs as a replacement for sh. It
> >may have many shells installed. 
> >And once you have telneted in, you already have shell access so do
> >not need shell access. 
> >The question is whether there are any externally listening programs
> >which use bash and which can be fed "carefully crafted" environment
> >variables from outside. 
> 
> #sh
> 
> BusyBox v1.00 (2012.02.06-00:34+0000) Built-in shell (msh)
> Enter 'help' for a list of built-in commands.
> 
> #cat /etc/services
> 
> 	Aw, c'mon, it's a start.
> 	[]'s

To find out what the default shell is, enter this...
  echo $SHELL
If it is bash and there are other shells installed, you can
change the default shell.
  chsh -s /bin/dash
or
  chsh -s /bin/sh
or whatever.

-- 
<Wildman> GNU/Linux user #557453
The cow died so I don't need your bull!

[toc] | [prev] | [next] | [standalone]

#3092

From	William Unruh <unruh@invalid.ca>
Date	2014-09-27 01:41 +0000
Message-ID	<m054l5$uiv$1@dont-email.me>
In reply to	#3091

On 2014-09-27, Wildman <best_lay@yahoo.com> wrote:
> On Fri, 26 Sep 2014 20:33:10 -0300
> Shadow <Sh@dow.br> wrote:
>
>> On Fri, 26 Sep 2014 23:18:16 +0000 (UTC), William Unruh
>> <unruh@invalid.ca> wrote:
>> 
>> >On 2014-09-26, Shadow <Sh@dow.br> wrote:
>> >> On Fri, 26 Sep 2014 05:44:50 +0000 (UTC), Ger Robertson
>> >><something@something.invalid> wrote:
>> >>
>> >>>Anyone know how we can tell if our WiFI routers and rooftop radios
>> >>>are affected by the Bash Shellshock vulnerability?
>> >>
>> >> 	Telnet (or Putty) into it and
>> >> 	sh
>> >> 	will tell you what shell it runs.
>> >> 	[]'s
>> >
>> >No it will tell you what shell it runs as a replacement for sh. It
>> >may have many shells installed. 
>> >And once you have telneted in, you already have shell access so do
>> >not need shell access. 
>> >The question is whether there are any externally listening programs
>> >which use bash and which can be fed "carefully crafted" environment
>> >variables from outside. 
>> 
>> #sh
>> 
>> BusyBox v1.00 (2012.02.06-00:34+0000) Built-in shell (msh)
>> Enter 'help' for a list of built-in commands.
>> 
>> #cat /etc/services
>> 
>> 	Aw, c'mon, it's a start.
>> 	[]'s
>
> To find out what the default shell is, enter this...
>   echo $SHELL

Different default. This is the default for that particular user-- the
shell that is opened up on a terminal when the user logs in. The
default I was talking about is the default that the system uses in
general- it is usually called sh, but most systems have /bin/sh pointing
to some other shell which also has the same commands as the classic sh
shell (such as bash). Writers expect sh to comply with certain standards
so for example /bin/tcsh would not be a good thing for /bin/sh to point
to because thestructure of tcsh is very different from the old sh.

> If it is bash and there are other shells installed, you can
> change the default shell.
>   chsh -s /bin/dash
> or
>   chsh -s /bin/sh
> or whatever.

That will change your own particular shell that is brought up when you
log in. Actually the latter will probably give you bash anyway, since
/bin/sh is often a link to /bin/bash. 

>

[toc] | [prev] | [next] | [standalone]

#3094

From	Shadow <Sh@dow.br>
Date	2014-09-26 23:29 -0300
Message-ID	<4q7c2adt3nub11o9po8pr82h21lm98vkrs@4ax.com>
In reply to	#3092

On Sat, 27 Sep 2014 01:41:58 +0000 (UTC), William Unruh
<unruh@invalid.ca> wrote:

>That will change your own particular shell that is brought up when you
>log in. Actually the latter will probably give you bash anyway, since
>/bin/sh is often a link to /bin/bash.

	Do you know any cheapo home routers (D-Link, Netgear, etc)
that actually use bash, and not BusyBox, or some other compact
"do-all" binary ?
	I know the expensive ones might use it, and the shell on my
homemade CD-Booted router/firewall running on an old AMD K6 was bash,
but bash is a bit of an overkill for a cheap home router.
	[]'s
-- 
Don't be evil - Google 2004
We have a new policy  - Google 2012

[toc] | [prev] | [next] | [standalone]

#3105

From	Michael Black <et472@ncf.ca>
Date	2014-09-28 20:37 -0400
Message-ID	<alpine.LNX.2.02.1409282036380.25093@darkstar.example.org>
In reply to	#3094

On Fri, 26 Sep 2014, Shadow wrote:

> On Sat, 27 Sep 2014 01:41:58 +0000 (UTC), William Unruh
> <unruh@invalid.ca> wrote:
>
>> That will change your own particular shell that is brought up when you
>> log in. Actually the latter will probably give you bash anyway, since
>> /bin/sh is often a link to /bin/bash.
>
> 	Do you know any cheapo home routers (D-Link, Netgear, etc)
> that actually use bash, and not BusyBox, or some other compact
> "do-all" binary ?
> 	I know the expensive ones might use it, and the shell on my
> homemade CD-Booted router/firewall running on an old AMD K6 was bash,
> but bash is a bit of an overkill for a cheap home router.
> 	[]'s

Then there are the TV sets (both of mine run Linux, but have no means of 
connecting to the Internet), and both my blu-ray players run Linux (and 
they do have ethernet ports).

   Michael

[toc] | [prev] | [next] | [standalone]

#3095

From	Wildman <best_lay@yahoo.com>
Date	2014-09-26 22:10 -0500
Message-ID	<20140926221057.192f5947.best_lay@yahoo.com>
In reply to	#3092

On Sat, 27 Sep 2014 01:41:58 +0000 (UTC)
William Unruh <unruh@invalid.ca> wrote:

> On 2014-09-27, Wildman <best_lay@yahoo.com> wrote:
> > On Fri, 26 Sep 2014 20:33:10 -0300
> > Shadow <Sh@dow.br> wrote:
> >
> >> On Fri, 26 Sep 2014 23:18:16 +0000 (UTC), William Unruh
> >> <unruh@invalid.ca> wrote:
> >> 
> >> >On 2014-09-26, Shadow <Sh@dow.br> wrote:
> >> >> On Fri, 26 Sep 2014 05:44:50 +0000 (UTC), Ger Robertson
> >> >><something@something.invalid> wrote:
> >> >>
> >> >>>Anyone know how we can tell if our WiFI routers and rooftop
> >> >>>radios are affected by the Bash Shellshock vulnerability?
> >> >>
> >> >> 	Telnet (or Putty) into it and
> >> >> 	sh
> >> >> 	will tell you what shell it runs.
> >> >> 	[]'s
> >> >
> >> >No it will tell you what shell it runs as a replacement for sh. It
> >> >may have many shells installed. 
> >> >And once you have telneted in, you already have shell access so do
> >> >not need shell access. 
> >> >The question is whether there are any externally listening
> >> >programs which use bash and which can be fed "carefully crafted"
> >> >environment variables from outside. 
> >> 
> >> #sh
> >> 
> >> BusyBox v1.00 (2012.02.06-00:34+0000) Built-in shell (msh)
> >> Enter 'help' for a list of built-in commands.
> >> 
> >> #cat /etc/services
> >> 
> >> 	Aw, c'mon, it's a start.
> >> 	[]'s
> >
> > To find out what the default shell is, enter this...
> >   echo $SHELL
> 
> Different default. This is the default for that particular user-- the
> shell that is opened up on a terminal when the user logs in. The
> default I was talking about is the default that the system uses in
> general- it is usually called sh, but most systems have /bin/sh
> pointing to some other shell which also has the same commands as the
> classic sh shell (such as bash). Writers expect sh to comply with
> certain standards so for example /bin/tcsh would not be a good thing
> for /bin/sh to point to because thestructure of tcsh is very
> different from the old sh.

On a Linux/Unix system that is true.  I don't think routers
support multiple users or do they?

> > If it is bash and there are other shells installed, you can
> > change the default shell.
> >   chsh -s /bin/dash
> > or
> >   chsh -s /bin/sh
> > or whatever.
> 
> That will change your own particular shell that is brought up when you
> log in. 

If routers support only one user, that would not be an issue.
Even so, it is possible to change the default shell for all
users.

> Actually the latter will probably give you bash anyway, since
> /bin/sh is often a link to /bin/bash. 

On my system, SolydX, sh points to dash.  The same is true
for Mint, Ubuntu and MX-14.  Don't know about any others.

-- 
<Wildman> GNU/Linux user #557453
The cow died so I don't need your bull!

[toc] | [prev] | [next] | [standalone]

#3098

From	Chris Ahlstrom <OFeem1987@teleworm.us>
Date	2014-09-27 06:42 -0400
Message-ID	<m0649r$l78$3@dont-email.me>
In reply to	#3095

Wildman wrote this copyrighted missive and expects royalties:

> On Sat, 27 Sep 2014 01:41:58 +0000 (UTC)
> William Unruh <unruh@invalid.ca> wrote:
>
>> >
>> > To find out what the default shell is, enter this...
>> >   echo $SHELL
>> 
>> Different default. This is the default for that particular user-- the
>> shell that is opened up on a terminal when the user logs in. The
>> default I was talking about is the default that the system uses in
>> general- it is usually called sh, but most systems have /bin/sh
>> pointing to some other shell which also has the same commands as the
>> classic sh shell (such as bash). Writers expect sh to comply with
>> certain standards so for example /bin/tcsh would not be a good thing
>> for /bin/sh to point to because thestructure of tcsh is very
>> different from the old sh.
>
> On a Linux/Unix system that is true.  I don't think routers
> support multiple users or do they?
>
>> > If it is bash and there are other shells installed, you can
>> > change the default shell.
>> >   chsh -s /bin/dash
>> > or
>> >   chsh -s /bin/sh
>> > or whatever.
>> 
>> That will change your own particular shell that is brought up when you
>> log in. 
>
> If routers support only one user, that would not be an issue.
> Even so, it is possible to change the default shell for all
> users.
>
>> Actually the latter will probably give you bash anyway, since
>> /bin/sh is often a link to /bin/bash. 
>
> On my system, SolydX, sh points to dash.  The same is true
> for Mint, Ubuntu and MX-14.  Don't know about any others.

That's long been true for Debian, I believe.  It is certainly true right
now.

-- 
A man can have two, maybe three love affairs while he's married.  After
that it's cheating.
		-- Yves Montand

[toc] | [prev] | [next] | [standalone]

Page 1 of 2 [1] 2 Next page →

csiph-web

Are our WiFI routers and rooftop radios affected by the Bash Shellshock vulnerability?

Contents

#3080 — Are our WiFI routers and rooftop radios affected by the Bash Shellshock vulnerability?

#3081

#3082

#3083

#3084

#3085

#3102

#3110

#3111

#3112

#3114

#3086

#3088

#3089

#3091

#3092

#3094

#3105

#3095

#3098