<story><title>Bash &apos;shellshock&apos; bug is wormable</title><url>http://blog.erratasec.com/2014/09/bash-shellshock-bug-is-wormable.html</url></story><parent_chain><item><author>cperciva</author><text>&lt;i&gt;I run no Linux&amp;#x2F;Unix&amp;#x2F;MacOS&amp;#x2F;compatible&amp;#x2F;etc machine which connects other machines&lt;/i&gt;&lt;p&gt;How about &amp;quot;I don&amp;#x27;t run bash&amp;quot;?  There are other perfectly good shells, you know...</text></item><item><author>patio11</author><text>Yep. We&amp;#x27;re currently &lt;i&gt;basically&lt;/i&gt; waiting to see which completes first: a) a patch for bash which actually works gets released and then trickles into the various ways to get it on every machine in the world or b) someone writes ~10 lines of payload code (download rootkit, execute, connect to IRC channel, join botnet, etc) and then just hits everything in IP4 space with a for loop.  Optionally, the for loop gets distributed to new nodes joining the bot net.&lt;p&gt;If you cannot say &amp;quot;I run no Linux&amp;#x2F;Unix&amp;#x2F;MacOS&amp;#x2F;compatible&amp;#x2F;etc machine which connects other machines&amp;quot; you should be at battle stations right now.  We&amp;#x27;re all racing against a for loop and the for loop will probably have a head start.</text></item></parent_chain><comment><author>quesera</author><text>Or &amp;quot;I don&amp;#x27;t run UNIXes that default to bash, or hide it under &amp;#x2F;bin&amp;#x2F;sh, etc.&amp;quot;&lt;p&gt;Unfortunately, bash shows up in surprising places, including default Solaris installs nowadays.&lt;p&gt;On OSX and Solaris, I&amp;#x27;ve chmod&amp;#x27;ed 0000 &amp;#x2F;bin&amp;#x2F;bash with no apparent ill effect so far. I&amp;#x27;ll put more effort into establishing its acceptability as a solution tomorrow.&lt;p&gt;BSDs won&amp;#x27;t have bash unless someone has gone out of their way to install it, which can be undone straightforwardly.&lt;p&gt;But it could be a long night for our Linux brethren and sistren.&lt;p&gt;Good luck, and remember to stay hydrated. :)&lt;p&gt;EDIT: obviously, don&amp;#x27;t chmod 0000 your login shell! Fix that first. Make sure whatever you switch to isn&amp;#x27;t a symbolic or hard link to bash.</text></comment>
<story><title>Bash &apos;shellshock&apos; bug is wormable</title><url>http://blog.erratasec.com/2014/09/bash-shellshock-bug-is-wormable.html</url></story><parent_chain><item><author>cperciva</author><text>&lt;i&gt;I run no Linux&amp;#x2F;Unix&amp;#x2F;MacOS&amp;#x2F;compatible&amp;#x2F;etc machine which connects other machines&lt;/i&gt;&lt;p&gt;How about &amp;quot;I don&amp;#x27;t run bash&amp;quot;?  There are other perfectly good shells, you know...</text></item><item><author>patio11</author><text>Yep. We&amp;#x27;re currently &lt;i&gt;basically&lt;/i&gt; waiting to see which completes first: a) a patch for bash which actually works gets released and then trickles into the various ways to get it on every machine in the world or b) someone writes ~10 lines of payload code (download rootkit, execute, connect to IRC channel, join botnet, etc) and then just hits everything in IP4 space with a for loop.  Optionally, the for loop gets distributed to new nodes joining the bot net.&lt;p&gt;If you cannot say &amp;quot;I run no Linux&amp;#x2F;Unix&amp;#x2F;MacOS&amp;#x2F;compatible&amp;#x2F;etc machine which connects other machines&amp;quot; you should be at battle stations right now.  We&amp;#x27;re all racing against a for loop and the for loop will probably have a head start.</text></item></parent_chain><comment><author>patio11</author><text>You and Thomas can ignore everything I say about security.  J. Random Rails Developer, on the other hand, probably gets useful signal if I start panicking.  (Am I panicking?  YES.)</text></comment>