CVE-2014-6271

[flymolon]

Hi,
Is it CVE-2014-6271 detection available now?

Thanks!



flymolon

[Chris]

Hi,

Post by flymolon
Is it CVE-2014-6271 detection available now?

yes since yesterday:

http://lists.wald.intevation.org/pipermail/openvas-nvts-commits/2014-September/000693.html

[Chris]

Ah, forgot to mention. There are way more attack possibilities which are collected in:

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169

[Chris]

Hi,

most infos and different test patterns are now collected here:

https://shellshocker.net/

[Rainer Sokoll]

Post by Chris

Post by flymolon
Is it CVE-2014-6271 detection available now?

http://lists.wald.intevation.org/pipermail/openvas-nvts-commits/2014-September/000693.html

Does it really work? If I let it run against a webserver:

openvas-nasl -d -t www.example.com -X -T out /var/lib/openvas/plugins/gb_bash_shellshock_remote_cmd_exec_vuln.nasl

All I see in the webserver’s log is this:

x.x.x.x - - [26/Sep/2014:11:37:30 +0200] "GET / HTTP/1.1" 200 48163 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)“
x.x.x.x - - [26/Sep/2014:11:37:30 +0200] "GET /test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)“
x.x.x.x - - [26/Sep/2014:11:37:30 +0200] "GET /cgi-bin/test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)“
x.x.x.x - - [26/Sep/2014:11:37:31 +0200] "GET /cgi-bin/test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)“
x.x.x.x - - [26/Sep/2014:11:37:31 +0200] "GET /scripts/test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)“
x.x.x.x - - [26/Sep/2014:11:37:31 +0200] "GET //test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)“

Still digging through the output of openvas-nasl…

Rainer

[Christiaan DeVries]

Hi all,

After running all synchronisations, am still don't have the shellshock detection, any hints as to what could be wrong with my system?

Regards,

Christiaan de Vries
w: [phone] | m: [phone] | e: christiaan.devries @hetg.ie | www.DigitalPlanet.ie | www.hetg.ie
HIBERNIA HOUSE | Cherrywood Business Park | Loughlinstown | Dublin 18 | Ireland
Hibernia Services Ltd. is registered in Ireland, Company Registration No. 170309
© 2014 Digital Planet, part of the HiberniaEvros Technology Group

-----Original Message-----
From: Openvas-discuss [mailto:openvas-discuss-***@wald.intevation.org] On Behalf Of Rainer Sokoll
Sent: 26 September 2014 10:45
To: openvas-discuss
Subject: Re: [Openvas-discuss] CVE-2014-6271

Post by Chris

Post by flymolon
Is it CVE-2014-6271 detection available now?

http://lists.wald.intevation.org/pipermail/openvas-nvts-commits/2014-S
eptember/000693.html

Does it really work? If I let it run against a webserver:

openvas-nasl -d -t www.example.com -X -T out /var/lib/openvas/plugins/gb_bash_shellshock_remote_cmd_exec_vuln.nasl

All I see in the webserver's log is this:

x.x.x.x - - [26/Sep/2014:11:37:30 +0200] "GET / HTTP/1.1" 200 48163 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - - [26/Sep/2014:11:37:30 +0200] "GET /test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - - [26/Sep/2014:11:37:30 +0200] "GET /cgi-bin/test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - - [26/Sep/2014:11:37:31 +0200] "GET /cgi-bin/test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - - [26/Sep/2014:11:37:31 +0200] "GET /scripts/test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - - [26/Sep/2014:11:37:31 +0200] "GET //test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)"

Still digging through the output of openvas-nasl.

Rainer

[Rainer Sokoll]

Post by Christiaan DeVries
After running all synchronisations, am still don't have the shellshock detection, any hints as to what could be wrong with my system?

Same here. I grabbed it directly from http://lists.wald.intevation.org/pipermail/openvas-nvts-commits/2014-September/000693.html

Rainer

[Chris]

It should be available at Web application abuses and cgi scanning needs to be enabled.

Also check the older heartbleed mailing list thread for some hints when missing a NVT.

[Rainer Sokoll]

Post by Rainer Sokoll

Post by Chris

Post by flymolon
Is it CVE-2014-6271 detection available now?

http://lists.wald.intevation.org/pipermail/openvas-nvts-commits/2014-September/000693.html

openvas-nasl -d -t www.example.com -X -T out /var/lib/openvas/plugins/gb_bash_shellshock_remote_cmd_exec_vuln.nasl
x.x.x.x - - [26/Sep/2014:11:37:30 +0200] "GET / HTTP/1.1" 200 48163 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)“
x.x.x.x - - [26/Sep/2014:11:37:30 +0200] "GET /test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)“
x.x.x.x - - [26/Sep/2014:11:37:30 +0200] "GET /cgi-bin/test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)“
x.x.x.x - - [26/Sep/2014:11:37:31 +0200] "GET /cgi-bin/test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)“
x.x.x.x - - [26/Sep/2014:11:37:31 +0200] "GET /scripts/test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)“
x.x.x.x - - [26/Sep/2014:11:37:31 +0200] "GET //test-cgi HTTP/1.1" 404 1040 "-" "Mozilla/4.75 [en] (X11, U; OpenVAS)“

Stupid me.

Ouf course, the nvt needs a script to tst. And since it cannot know which scripts are available on a webserver, it simply tries / plus 5 common cgi scripts. If these scripts do not exist (or they ain’t a cgi script) - then there is nothing to test.

Apologies to the author: The script works as expected.

Rainer

[Christiaan DeVries]

Hi Rainer,

What exactly do you mean by the NVT needs a script to test? Basically, I'm trying to come up with a way I can (mass) scan our networks but as I'm quite new to OpenVAS I feel I'm missing something here.

When I run the check, I get the following output:
[***@openvas openvas]# openvas-nasl -d -t 172.26.128.0/24 -X -T out /var/lib/openvas/plugins/gb_bash_shellshock_remote_cmd_exec_vuln.nasl
set key www/80/keepalive -> yes

Anything else I should be adding to identify vulnerable machines?

Christiaan de Vries
w: [phone] | m: [phone] | e: christiaan.devries @hetg.ie | www.DigitalPlanet.ie | www.hetg.ie
HIBERNIA HOUSE | Cherrywood Business Park | Loughlinstown | Dublin 18 | Ireland
Hibernia Services Ltd. is registered in Ireland, Company Registration No. 170309
© 2014 Digital Planet, part of the HiberniaEvros Technology Group

-----Original Message-----
From: Openvas-discuss [mailto:openvas-discuss-***@wald.intevation.org] On Behalf Of Rainer Sokoll
Sent: 26 September 2014 11:45
To: openvas-discuss
Subject: Re: [Openvas-discuss] CVE-2014-6271

Post by Rainer Sokoll

Post by Chris

Post by flymolon
Is it CVE-2014-6271 detection available now?

http://lists.wald.intevation.org/pipermail/openvas-nvts-commits/2014-
September/000693.html

openvas-nasl -d -t www.example.com -X -T out
/var/lib/openvas/plugins/gb_bash_shellshock_remote_cmd_exec_vuln.nasl
x.x.x.x - - [26/Sep/2014:11:37:30 +0200] "GET / HTTP/1.1" 200 48163
"-" "Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - -
[26/Sep/2014:11:37:30 +0200] "GET /test-cgi HTTP/1.1" 404 1040 "-"
"Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - -
[26/Sep/2014:11:37:30 +0200] "GET /cgi-bin/test-cgi HTTP/1.1" 404 1040
"-" "Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - -
[26/Sep/2014:11:37:31 +0200] "GET /cgi-bin/test-cgi HTTP/1.1" 404 1040
"-" "Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - -
[26/Sep/2014:11:37:31 +0200] "GET /scripts/test-cgi HTTP/1.1" 404 1040
"-" "Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - -
[26/Sep/2014:11:37:31 +0200] "GET //test-cgi HTTP/1.1" 404 1040 "-"
"Mozilla/4.75 [en] (X11, U; OpenVAS)"

Stupid me.

Ouf course, the nvt needs a script to tst. And since it cannot know which scripts are available on a webserver, it simply tries / plus 5 common cgi scripts. If these scripts do not exist (or they ain't a cgi script) - then there is nothing to test.

Apologies to the author: The script works as expected.

Rainer

[Chris]

Hi,

as far as i can see the default:

/test-cgi

needs to be in your cgi folder for a successful running test with this NVT.

Post by Christiaan DeVries
Hi Rainer,
What exactly do you mean by the NVT needs a script to test? Basically,
I'm trying to come up with a way I can (mass) scan our networks but as
I'm quite new to OpenVAS I feel I'm missing something here.
/var/lib/openvas/plugins/gb_bash_shellshock_remote_cmd_exec_vuln.nasl
set key www/80/keepalive -> yes
Anything else I should be adding to identify vulnerable machines?
Christiaan de Vries
w: [phone] | m: [phone] | e: christiaan.devries
@hetg.ie | www.DigitalPlanet.ie | www.hetg.ie
HIBERNIA HOUSE | Cherrywood Business Park | Loughlinstown | Dublin 18 | Ireland
Hibernia Services Ltd. is registered in Ireland, Company Registration No. 170309
© 2014 Digital Planet, part of the HiberniaEvros Technology Group
-----Original Message-----
From: Openvas-discuss
Rainer Sokoll
Sent: 26 September 2014 11:45
To: openvas-discuss
Subject: Re: [Openvas-discuss] CVE-2014-6271

Post by Rainer Sokoll

Post by Chris

Post by flymolon
Is it CVE-2014-6271 detection available now?

http://lists.wald.intevation.org/pipermail/openvas-nvts-commits/2014-

Post by Rainer Sokoll

Post by Chris
September/000693.html

openvas-nasl -d -t www.example.com -X -T out
/var/lib/openvas/plugins/gb_bash_shellshock_remote_cmd_exec_vuln.nasl
x.x.x.x - - [26/Sep/2014:11:37:30 +0200] "GET / HTTP/1.1" 200 48163
"-" "Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - -
[26/Sep/2014:11:37:30 +0200] "GET /test-cgi HTTP/1.1" 404 1040 "-"
"Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - -
[26/Sep/2014:11:37:30 +0200] "GET /cgi-bin/test-cgi HTTP/1.1" 404

1040

Post by Rainer Sokoll
"-" "Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - -
[26/Sep/2014:11:37:31 +0200] "GET /cgi-bin/test-cgi HTTP/1.1" 404

1040

Post by Rainer Sokoll
"-" "Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - -
[26/Sep/2014:11:37:31 +0200] "GET /scripts/test-cgi HTTP/1.1" 404

1040

Post by Rainer Sokoll
"-" "Mozilla/4.75 [en] (X11, U; OpenVAS)" x.x.x.x - -
[26/Sep/2014:11:37:31 +0200] "GET //test-cgi HTTP/1.1" 404 1040 "-"
"Mozilla/4.75 [en] (X11, U; OpenVAS)"

Stupid me.
Ouf course, the nvt needs a script to tst. And since it cannot know
which scripts are available on a webserver, it simply tries / plus 5
common cgi scripts. If these scripts do not exist (or they ain't a cgi
script) - then there is nothing to test.
Apologies to the author: The script works as expected.
Rainer
_______________________________________________
Openvas-discuss mailing list
https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss
_______________________________________________
Openvas-discuss mailing list
https://lists.wald.intevation.org/cgi-bin/mailman/listinfo/openvas-discuss

[Chris]

Hi,

just as a follow-up:

Seems SIP proxies are also vulnerable:

https://github.com/zaf/sipshock

[Chris]

Same goes for qmail:

http://www.gossamer-threads.com/lists/qmail/users/138568

[Chris]

Hi,

and as another follow-up:

A nice list of vulnerable software/systems is available here:

https://github.com/mubix/shellshocker-pocs

[Michael Meyer]

Post by Christiaan DeVries
What exactly do you mean by the NVT needs a script to test?
Basically, I'm trying to come up with a way I can (mass) scan our
networks but as I'm quite new to OpenVAS I feel I'm missing
something here.
set key www/80/keepalive -> yes
Anything else I should be adding to identify vulnerable machines?

Store http://pastebin.com/TYu2ZLWY under "/path/to/webserver/cgi-bin/test-cgi".
Run a scan and it should be detected. This is only needed at the
moment if that file doesn't exist. We will update the NVT as soon as
possible.

Micha

[Rainer Sokoll]

Am 26.09.2014 um 14:05 schrieb Christiaan DeVries <***@hetg.ie>:

I’m new as well, so take all cum grano salis ;-)

Post by Christiaan DeVries
What exactly do you mean by the NVT needs a script to test? Basically, I'm trying to come up with a way I can (mass) scan our networks but as I'm quite new to OpenVAS I feel I'm missing something here.
set key www/80/keepalive -> yes

gb_bash_shellshock_remote_cmd_exec_vuln.nasl looks for

/test-cgi
/cgi-bin/test-cgi
/scripts/test-cgi

So you would need to have at least one of these scripts on your webserver to see what happens. (you may write it on your own)
If you are vulnerable, your scanner should return the victim’s date, see lines 108 ff. of gb_bash_shellshock_remote_cmd_exec_vuln.nasl)

Rainer

[Phillip Rice]

Hi

Is there any way we can run a test like the example

Post by Rainer Sokoll
/var/lib/openvas/plugins/gb_bash_shellshock_remote_cmd_exec_vuln.nasl
set key www/80/keepalive -> yes

But have it use credentials and actually run a bash shell command like

env x='() { (a)=>\' bash -c "echo ls /tmp ; cat echo"

and check if the file echo is created with the contents of /tmp

This would validate the latest patch from RedHat

CVE-2014-6271, CVE-2014-7169

https://access.redhat.com/articles/1200223

Thanks


Phillip Rice

This email may contain confidential information that is intended only for the listed recipient(s) of this email. Any unauthorized review, use, disclosure or distribution is prohibited. If you believe you have received this email in error, please immediately delete this email and any attachments, and inform me via reply e-mail.

-----Original Message-----
From: Openvas-discuss [mailto:openvas-discuss-***@wald.intevation.org] On Behalf Of Rainer Sokoll
Sent: 26 September 2014 13:21
To: openvas-***@wald.intevation.org
Subject: Re: [Openvas-discuss] CVE-2014-6271


Am 26.09.2014 um 14:05 schrieb Christiaan DeVries <***@hetg.ie>:

I'm new as well, so take all cum grano salis ;-)

Post by Rainer Sokoll
What exactly do you mean by the NVT needs a script to test? Basically, I'm trying to come up with a way I can (mass) scan our networks but as I'm quite new to OpenVAS I feel I'm missing something here.
/var/lib/openvas/plugins/gb_bash_shellshock_remote_cmd_exec_vuln.nasl
set key www/80/keepalive -> yes

gb_bash_shellshock_remote_cmd_exec_vuln.nasl looks for

/test-cgi
/cgi-bin/test-cgi
/scripts/test-cgi

So you would need to have at least one of these scripts on your webserver to see what happens. (you may write it on your own) If you are vulnerable, your scanner should return the victim's date, see lines 108 ff. of gb_bash_shellshock_remote_cmd_exec_vuln.nasl)

Rainer

[Michael Meyer]

Post by Phillip Rice
But have it use credentials and actually run a bash shell command like
env x='() { (a)=>\' bash -c "echo ls /tmp ; cat echo"

A local check will also released soon.

Micha