[重要]bashにて脆弱性(shellshock) - とあるサーバエンジニアの備忘録

今年は、Linux関連で大きい脆弱性が報告されすぎだと思うのは私だけだろうか。

さて、久々に記事を更新した理由は表題にある通り、bashにて重大な脆弱性(「CVE-2014-6271」)が報告されたからだ。
余談だが影響範囲は以前opensslであった脆弱性より大きいとのこと。
サーバ管理者にはこれまた負担の大きい脆弱性だ・・・

ちなみに私が所有しているサーバの内は検証用とCentOS4系を除いてすべてアップデートしました。
なぜ、検証用はしなかったってこの記事のため、CentOS4系はサポート終了していてyumでアップデート出来なかったからだ。　←俗に言うサポート切れ

一部ですが、私の検証内容は以下の通りです。(centos6系)

■検証とアップデート作業
1.sshやtelnet、コンソールでlinuxへ接続し、bashを使えるようにする
通常ではログイン後のシェルがbashになっていることがほとんど

# echo $SHELL
/bin/bash

# echo $SHELL

/bin/bash

2.rpmパッケージ(yumインストールの場合もこれでOK)でインストールされているもののバージョンを確認

# rpm -q bash
bash-4.1.2-14.el6.x86_64

# rpm -q bash

bash-4.1.2-14.el6.x86_64

3.(ここからが重要)脆弱性確認用コマンドを実行

# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test

# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

vulnerable

this is a test

さて、「vulnerable」という文字が表示されたでしょうか
表示された方はもれなく、脆弱性の対象です。
※「vulnerable」という文字が表示されなければ、一安心です。

4.「vulnerable」という文字が表示された方はbashのアップデートが可能か確認

# yum info bash
Installed Packages
Name        : bash
Arch        : x86_64
Version     : 4.1.2
Release     : 14.el6
Size        : 3.0 M
Repo        : installed
From repo   : CentOS6-Base
Summary     : The GNU Bourne Again shell
URL         : http://www.gnu.org/software/bash
License     : GPLv3+
Description : The GNU Bourne Again shell (Bash) is a shell or command language
            : interpreter that is compatible with the Bourne shell (sh). Bash
            : incorporates useful features from the Korn shell (ksh) and the C shell
            : (csh). Most sh scripts can be run by bash without modification.

Available Packages
Name        : bash
Arch        : x86_64
Version     : 4.1.2
Release     : 15.el6_5.2
Size        : 905 k
Repo        : updates
Summary     : The GNU Bourne Again shell
URL         : http://www.gnu.org/software/bash
License     : GPLv3+
Description : The GNU Bourne Again shell (Bash) is a shell or command language
            : interpreter that is compatible with the Bourne shell (sh). Bash
            : incorporates useful features from the Korn shell (ksh) and the C shell
            : (csh). Most sh scripts can be run by bash without modification.&lt;br&gt;

# yum info bash

Installed Packages

Name : bash

Arch : x86_64

Version : 4.1.2

Release : 14.el6

Size : 3.0 M

Repo : installed

From repo : CentOS6-Base

Summary : The GNU Bourne Again shell

URL : http://www.gnu.org/software/bash

License : GPLv3+

Description : The GNU Bourne Again shell (Bash) is a shell or command language

: interpreter that is compatible with the Bourne shell (sh). Bash

: incorporates useful features from the Korn shell (ksh) and the C shell

: (csh). Most sh scripts can be run by bash without modification.

Available Packages

Name : bash

Arch : x86_64

Version : 4.1.2

Release : 15.el6_5.2

Size : 905 k

Repo : updates

Summary : The GNU Bourne Again shell

URL : http://www.gnu.org/software/bash

License : GPLv3+

Description : The GNU Bourne Again shell (Bash) is a shell or command language

: interpreter that is compatible with the Bourne shell (sh). Bash

: incorporates useful features from the Korn shell (ksh) and the C shell

: (csh). Most sh scripts can be run by bash without modification.<br>

5.bashのアップデートが可能ならアップデートを実施

# yum update bash
Resolving Dependencies
--&gt; Running transaction check
---&gt; Package bash.x86_64 0:4.1.2-14.el6 will be updated
---&gt; Package bash.x86_64 0:4.1.2-15.el6_5.2 will be an update
--&gt; Finished Dependency Resolution

Dependencies Resolved

======================================================================================================================================
 Package                    Arch                         Version                                  Repository                     Size
======================================================================================================================================
Updating:
 bash                       x86_64                       4.1.2-15.el6_5.2                         updates                       905 k

Transaction Summary
======================================================================================================================================
Upgrade       1 Package(s)

Total download size: 905 k
Is this ok [y/N]: y
Downloading Packages:
Setting up and reading Presto delta metadata
updates/prestodelta                                                                                            | 507 kB     00:00
Processing delta metadata
/usr/share/locale/af/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/bg/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/ca/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/cs/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/de/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/en@boldquot/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/en@quot/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/eo/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/es/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/et/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/fi/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/fr/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/ga/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/hu/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/id/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/ja/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/lt/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/nl/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/pl/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/pt_BR/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/ro/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/ru/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/sk/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/sv/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/tr/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/vi/LC_MESSAGES/bash.mo: No such file or directory
/usr/share/locale/zh_TW/LC_MESSAGES/bash.mo: No such file or directory
delta does not match installed data
Package(s) data still to download: 905 k
bash-4.1.2-15.el6_5.2.x86_64.rpm                                                                               | 905 kB     00:00
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Updating   : bash-4.1.2-15.el6_5.2.x86_64                                                                                       1/2
  Cleanup    : bash-4.1.2-14.el6.x86_64                                                                                           2/2
  Verifying  : bash-4.1.2-15.el6_5.2.x86_64                                                                                       1/2
  Verifying  : bash-4.1.2-14.el6.x86_64                                                                                           2/2

Updated:
  bash.x86_64 0:4.1.2-15.el6_5.2

Complete!

# yum update bash

Resolving Dependencies

--> Running transaction check

---> Package bash.x86_64 0:4.1.2-14.el6 will be updated

---> Package bash.x86_64 0:4.1.2-15.el6_5.2 will be an update

--> Finished Dependency Resolution

Dependencies Resolved

======================================================================================================================================

Package Arch Version Repository Size

======================================================================================================================================

Updating:

bash x86_64 4.1.2-15.el6_5.2 updates 905 k

Transaction Summary

======================================================================================================================================

Upgrade 1 Package(s)

Total download size: 905 k

Is this ok [y/N]: y

Downloading Packages:

Setting up and reading Presto delta metadata

updates/prestodelta | 507 kB 00:00

Processing delta metadata

/usr/share/locale/af/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/bg/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/ca/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/cs/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/de/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/en@boldquot/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/en@quot/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/eo/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/es/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/et/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/fi/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/fr/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/ga/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/hu/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/id/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/ja/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/lt/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/nl/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/pl/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/pt_BR/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/ro/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/ru/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/sk/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/sv/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/tr/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/vi/LC_MESSAGES/bash.mo: No such file or directory

/usr/share/locale/zh_TW/LC_MESSAGES/bash.mo: No such file or directory

delta does not match installed data

Package(s) data still to download: 905 k

bash-4.1.2-15.el6_5.2.x86_64.rpm | 905 kB 00:00

Running rpm_check_debug

Running Transaction Test

Transaction Test Succeeded

Running Transaction

Updating : bash-4.1.2-15.el6_5.2.x86_64 1/2

Cleanup : bash-4.1.2-14.el6.x86_64 2/2

Verifying : bash-4.1.2-15.el6_5.2.x86_64 1/2

Verifying : bash-4.1.2-14.el6.x86_64 2/2

Updated:

bash.x86_64 0:4.1.2-15.el6_5.2

Complete!

6.bashのアップデートが終われば、再度脆弱性確認用コマンドを実行してみる

# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
this is a test

# env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

this is a test

「vulnerable」という文字が表示されなくなっていればOK

■余談
今回の脆弱性では、bash(shも含む)スクリプトであるシェルスクリプトでも影響があります。
そのため、シェルスクリプトをCGIスクリプトとして実行しているあなた、既に攻撃を食らっている可能性があります。
当ブログのアクセスログにも「"() { :; }; ping -c 11 WWW.XXX.YYY.ZZZ"」というログが残っておりました。
※PING先のIPアドレスは伏せております。
恐らくPING(ICMPのパケット)が相手先に現れれば、脆弱性対象というスキャンをしていたのでしょう。

centos4系はどうするか、ソースからコンパイル？

■参考サイト
http://d.hatena.ne.jp/Kango/20140925/1411612246
https://access.redhat.com/ja/node/1210893
https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html#.VCX1Pmd_srU
http://www.ne.jp/asahi/hishidama/home/tech/unix/vulnerability/bash_shellshock.html#h_confirm

SNOWSKI