Second Bash-fix portholes on




The second patch for the vulnerability in Bash, which allows attackers to perform on a system, code appears like the first patch insufficient. It sometimes still appears to be possible to perform. Code on a system

The new vulnerability, which the Japanese security researcher Norihiro Tanaka discovered , is harder to abuse than the old vulnerability that Wednesday outside came . In addition, an attacker could add their own code to an environment variable, after which it was run once the code is a Bash shell invoked.

On the night of Thursday to Friday came a second patch for the vulnerability, but also those thus appears to circumvent in certain cases. An attacker could a normal Linux commands, such as ‘cat’ for reading files, create an environment variable and there code in hiding. Then the code in the environment variable is hidden ‘more often than not’ carried writes Tanaka.

According to security researcher David Wheeler is the patch from Thursday night to appreciate, but the underlying problem lies deeper. Bash should according to him to stop the automatic processing of environment variables. Does not happen, then it did not resolve completely the problem he thinks. “I have no confidence that the current patches will hold against anyone,” said Wheeler, who will know that he has removed sites from the air and not afraid to shop online for fear of the problem.

The problem is that Bash more backwards would not be as environment variables are no longer automatically parsed, so many older software will not work anymore. Compatible At the same time it will not completely solve the problem. The problem is that user devices like routers, NAS systems and even wireless webcams with an embedded Web server patching is often slower than a desktop operating system, and therefore, may be vulnerable. Many years

The latter is also one of the reasons that security researcher Robert Graham bug ‘as big as Heart Bleed’ calls. That was a vulnerability in OpenSSL which a portion of the contents of the internal memory of a server could be read.


In: Technology & Gadgets Asked By: [15554 Red Star Level]

Answer this Question

You must be Logged In to post an Answer.

Not a member yet? Sign Up Now »