<div dir="ltr">Hi,<div><br></div><div>please everybody, who is using PyWPS and is calling some command line programs (such as grass modules), make sure, you update your BASH installation.</div><div><br></div><div>PyWPS tries to check for proper data inputs, such as Integers or float numbers. Also pre-defined allowedValues list should work well for string data. Also PyWPS tries to determine some potencial dangerous characters (";" for example), but if you are allowing clients to send *any* type of string data, double check, it could not be misused on the server side</div><div><br></div><div>if you are using just python bindings to your libraries, it should be probably all right</div><div><br></div><div>Jachym</div></div><div class="gmail_extra"><br><div class="gmail_quote">2014-09-25 10:03 GMT+02:00 Jorge Samuel Mendes de Jesus <span dir="ltr"><<a href="mailto:jorge.mendesdejesus@wur.nl" target="_blank">jorge.mendesdejesus@wur.nl</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<br>
<div>Hi Jachym<br>
<br>
<br>
This could be serious problems for pywps. Since lots of people use
bash. Do you have some URL that we can test it ??? I got a new
desktop and have nothings installed<br>
<br>
J.<br>
<br>
<br>
<br>
-------- Forwarded Message --------
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<th align="RIGHT" nowrap valign="BASELINE">Subject:
</th>
<td>Re: [wurlug] CVE-2014-6271 bash: specially-crafted
environment variables can be used to inject shell commands</td>
</tr>
<tr>
<th align="RIGHT" nowrap valign="BASELINE">Date: </th>
<td>Thu, 25 Sep 2014 09:42:29 +0200</td>
</tr>
<tr>
<th align="RIGHT" nowrap valign="BASELINE">From: </th>
<td>Pjotr Prins <a href="mailto:pjotr.public11@thebird.nl" target="_blank"><pjotr.public11@thebird.nl></a></td>
</tr>
<tr>
<th align="RIGHT" nowrap valign="BASELINE">Reply-To:
</th>
<td>Unix at WUR (Wageningen University Research Center Linux
User Group)! <a href="mailto:wurlug@lists.nluug.nl" target="_blank"><wurlug@lists.nluug.nl></a></td>
</tr>
<tr>
<th align="RIGHT" nowrap valign="BASELINE">To: </th>
<td>Unix at WUR (Wageningen University Research Center Linux
User Group)! <a href="mailto:wurlug@lists.nluug.nl" target="_blank"><wurlug@lists.nluug.nl></a></td>
</tr>
</tbody>
</table>
<br>
<br>
<pre> <a href="https://community.qualys.com/blogs/laws-of-vulnerabilities/2014/09/24/bash-shellshock-vulnerability" target="_blank">https://community.qualys.com/blogs/laws-of-vulnerabilities/2014/09/24/bash-shellshock-vulnerability</a>
Also may work for Perl/Pyhton/Ruby cgi. Suspect firewall
configurators, database management and status scripts too. Test
telnet into port 80. Assuming your cgi script is at /cgi-bin/<a href="http://um.pl" target="_blank">um.pl</a>, type
the following in the telnet prompt:
GET /cgi-bin/<a href="http://um.pl" target="_blank">um.pl</a> HTTP/1.1
Host: localhost
Custom: () { :; }; while read -r l; do echo $l; done
Press ENTER twice after the last header.
the command is executed server-side.
(lifted from slashdot).
My servers are not vulnerable (I have avoided CGI for a long time and ssh is
restricted and throttled), but my routers do run CGI. Worth checking. They appear
to be fine without authenticated login.
Pj.
On Thu, Sep 25, 2014 at 05:50:19AM +0000, Haarst, Jan van wrote:
> Very, very bad news, update/harden your servers as soon as possible :
>
> <a href="https://access.redhat.com/security/cve/CVE-2014-6271" target="_blank">https://access.redhat.com/security/cve/CVE-2014-6271</a>
> <a href="http://seclists.org/oss-sec/2014/q3/650" target="_blank">http://seclists.org/oss-sec/2014/q3/650</a> :
>
>
> The technical details of the vulnerability follow.
>
> Bash supports exporting not just shell variables, but also shell
> functions to other bash instances, via the process environment to
> (indirect) child processes. Current bash versions use an environment
> variable named by the function name, and a function definition
> starting with ???() {??? in the variable value to propagate function
> definitions through the environment. The vulnerability occurs because
> bash does not stop after processing the function definition; it
> continues to parse and execute shell commands following the function
> definition. For example, an environment variable setting of
>
> VAR=() { ignored; }; /bin/id
>
> will execute /bin/id when the environment is imported into the bash
> process. (The process is in a slightly undefined state at this point.
> The PATH variable may not have been set up yet, and bash could crash
> after executing /bin/id, but the damage has already happened at this
> point.)
>
> The fact that an environment variable with an arbitrary name can be
> used as a carrier for a malicious function definition containing
> trailing commands makes this vulnerability particularly severe; it
> enables network-based exploitation.
>
>
>
> So far, HTTP requests to CGI scripts have been identified as the major
> attack vector.
>
> A typical HTTP request looks like this:
>
> GET /path?query-param-name=query-param-value HTTP/1.1
> Host: <a href="http://www.example.com" target="_blank">www.example.com</a><a href="http://www.example.com" target="_blank"><http://www.example.com></a>
> Custom: custom-header-value
>
> The CGI specification maps all parts to environment variables. With
> Apache httpd, the magic string ???() {??? can appear in these places:
>
> * Host (???<a href="http://www.example.com" target="_blank">www.example.com</a><a href="http://www.example.com" target="_blank"><http://www.example.com></a>???, as REMOTE_HOST)
> * Header value (???custom-header-value???, as HTTP_CUSTOM in this example)
> * Server protocol (???HTTP/1.1???, as SERVER_PROTOCOL)
>
> The user name embedded in an Authorization header could be a vector as
> well, but the corresponding REMOTE_USER variable is only set if the
> user name corresponds to a known account according to the
> authentication configuration, and a configuration which accepts the
> magic string appears somewhat unlikely.
>
> In addition, with other CGI implementations, the request method
> (???GET???), path (???/path???) and query string
> (???query-param-name=query-param-value???) may be vectors, and it is
> conceivable for ???query-param-value??? as well, and perhaps even
> ???query-param-name???.
>
> The other vector is OpenSSH, either through AcceptEnv variables, TERM
> or SSH_ORIGINAL_COMMAND.
>
> Other vectors involving different environment variable set by
> additional programs are expected.
>
>
> --
> Jan van Haarst
> Assistant Researcher Bioinformatics
> Applied Bioinformatics
> Wageningen UR, Plant Research International
> P.O Box 619, 6700 AP, Wageningen, the Netherlands
> Wageningen Campus, Building 107, Droevendaalsesteeg 1, 6708 PB, Wageningen, the Netherlands
> <a href="tel:%2B%2B31-317480756" value="+31317480756" target="_blank">++31-317480756</a>
> <a href="callto://jvhaarst" target="_blank">callto://jvhaarst</a>
> <a href="http://www.pri.wur.nl" target="_blank">www.pri.wur.nl</a><a href="http://www.pri.wur.nl/" target="_blank"><http://www.pri.wur.nl/></a>
> <a href="http://www.appliedbioinformatics.wur.nl" target="_blank">www.appliedbioinformatics.wur.nl</a><a href="http://www.appliedbioinformatics.wur.nl/" target="_blank"><http://www.appliedbioinformatics.wur.nl/></a>
> <a href="http://www.disclaimer-uk.wur.nl" target="_blank">www.disclaimer-uk.wur.nl</a><a href="http://www.disclaimer-uk.wur.nl/" target="_blank"><http://www.disclaimer-uk.wur.nl/></a>
>
>
>
>
>
>
>
> _______________________________________________
> Wurlug mailing list
> <a href="mailto:Wurlug@lists.nluug.nl" target="_blank">Wurlug@lists.nluug.nl</a>
> <a href="http://lists.nluug.nl/mailman/listinfo/wurlug" target="_blank">http://lists.nluug.nl/mailman/listinfo/wurlug</a>
_______________________________________________
Wurlug mailing list
<a href="mailto:Wurlug@lists.nluug.nl" target="_blank">Wurlug@lists.nluug.nl</a>
<a href="http://lists.nluug.nl/mailman/listinfo/wurlug" target="_blank">http://lists.nluug.nl/mailman/listinfo/wurlug</a>
</pre>
<br>
</div>
<br>
</div>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Jachym Cepicky<br>e-mail: jachym.cepicky gmail com<br>URL: <a href="http://les-ejk.cz" target="_blank">http://les-ejk.cz</a><br>GPG: <a href="http://les-ejk.cz/pgp/JachymCepicky.pgp" target="_blank">http://les-ejk.cz/pgp/JachymCepicky.pgp</a><br><br>Give your code freedom with PyWPS - <a href="http://pywps.wald.intevation.org" target="_blank">http://pywps.wald.intevation.org</a>
</div>