Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

9/26/2014
05:00 PM
50%
50%

Apple: Majority Of Mac OS X Users Not At Risk To 'Shellshock'

According to Apple, Mac OS X systems are not exposed to remote exploits of Bash unless users have certain UNIX services configured.

Apple says the so-called Shellshock bug does not impact the majority of Mac OS X users.

That may come as a bit of good news for Apple customers worried about the newly revealed vulnerability affecting GNU's Bourne Again Shell (Bash).

"The vast majority of OS X users are not at risk to recently reported Bash vulnerabilities," an Apple spokesperson told Dark Reading. "Bash, a UNIX command shell and language included in OS X, has a weakness that could allow unauthorized users to remotely gain control of vulnerable systems. With OS X, systems are safe by default and not exposed to remote exploits of Bash unless users configure advanced UNIX services. We are working to quickly provide a software update for our advanced UNIX users."

Apple did not specify what "advanced services" it meant. Eldon Sprickerhoff, chief security strategist at eSentire says they likely include "inbound services including ssh, web services (a.k.a. Apache)," and others. "My advice is, if you're running OS X as a web server, take it down until there's a patch or use something to block ShellShockish queries with a wrapper or something like Mod-security."

The vast majority of the attacks inbound on the Internet are through web servers, he says. "You use the web server to run a script that lets you exploit the bash bug. The web server is the vector to access the bug itself. So, if you have fewer open vectors available, you're less vulnerable. However, there's some indication that DHCP could be a vector for other systems. There's a whole new attack space to be analyzed here."

The Pluralsight author and security expert Troy Hunt wrote in a blog post that Bash is a *nix shell -- an interpreter that enables users to orchestrate commands on Unix and Linux systems, typically by connecting over SSH or Telnet. It can also operate as a parser for CGI scripts on a web server that would typically be seen running on Apache.

"There are other shells out there for Unix variants, the thing about Bash though is that it's the default shell for Linux and Mac OS X which are obviously extremely prevalent operating systems," he wrote. "That's a major factor in why this risk is so significant -- the ubiquity of Bash -- and it's being described as 'one of the most installed utilities on any Linux system.'"

The risk centers on "the ability to arbitrarily define environment variables within a Bash shell which specify a function definition," Hunt wrote. "The trouble begins when Bash continues to process shell commands after the function definition resulting in what we'd classify as a 'code injection attack.'"

Shortly after the bug was disclosed yesterday, the first attempts by criminals to take advantage of the issue began.

"The most recent attempts we see to gain control of web servers just create a new instance of Bash and redirect it to a remote server listening on a specific TCP port. This is also known as a reverse-connect-shell," Kaspersky Lab's Stefan Ortloff wrote in a blog post today. "In another ongoing attack the criminals are using a specially crafted HTTP-request to exploit the Bash vulnerability in order to install a Linux-backdoor on the victim's server. We're detecting the malware and its variants as Backdoor.Linux.Gafgyt."

The activity by attackers has led the Internet Storm Center to raise the 'InfoCon' status to Yellow.

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
9/30/2014 | 2:38:52 AM
Re: Apple is attempting to minimize.
I agree theb0x!
theb0x
50%
50%
theb0x,
User Rank: Ninja
9/29/2014 | 9:26:22 PM
Re: Apple is attempting to minimize.
The following conditions must be true in OSX to exploit the system:

1) Root must be enabled. The setting is pretty well hidden and the user must knowly access it. (System default is disabled in latest OSX.)

2) A local terminal session must be spawned with the following command followed by root password:

sudo systemsetup -setremotelogin on

This enables the SSH Daemon. How many average Apple users do you think have configured their systems this way? At this point I see this as nothing more than a social engineering attack for these system conditions to be true for most users. Unless they know what SSH is because they're a Sys Admin. I am not taking sides with Apple. Their security responses are a joke and always make me chuckle.
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
9/29/2014 | 11:02:09 AM
Re: Apple is attempting to minimize.
I agree, OS X is anyway affected by the Bash bug flaw and its announcement is giving a fake sense of security to many people that aren't able to check their systems.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
9/29/2014 | 9:12:11 AM
Re: Apple is attempting to minimize.
Very good point Robert. I think even if there is the possibility of a vulnerable configuration within your hardware that you need to account for it. How difficult would it be for Apple to design a quick app to check if the system settings you have on your Mac are vulnerable? 

The answer is not very difficult at all if it is just a series of enables/disables. If enabled true if not than false. A quick scan should be made available for all OSX users. I think it isn't too lofty of a request considered that this vulnerability was given the highest severity rating possible by NIST.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
9/28/2014 | 12:48:25 PM
Apple is attempting to minimize.
True, in order to be vulnerable to a remote execution you need to enable some inbound service, such as SSH.  However, the fact is that ALL versions of OSX have the vulnerability.  In my testing, every version of OSX, including the beta of Yosemite, have proved to be vulnerable.

I know Apple hasn't had to deal with major vulnerabilities routinely in the past, but this isn't the way to address it.  Apple should admit that all versions of OSX have the vulnerability but, users are not exposed unless they enable X, Y or Z.  They shouldn't leave the subject up for debate by making a nebulous statement such as "systems are safe by default and not exposed to remote exploits of Bash unless users configure advanced UNIX services".  This doesn't actually explain to users how they might currently be vulnerable, or what they may do for a work around.

Apple gets an F for this response in my book.

 
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
New Attack Campaigns Suggest Emotet Threat Is Far From Over
Jai Vijayan, Contributing Writer,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5216
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.9.0, 5.2.0, and 6.3.0. If user-supplied input was passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seei...
CVE-2020-5217
PUBLISHED: 2020-01-23
In Secure Headers (RubyGem secure_headers), a directive injection vulnerability is present in versions before 3.8.0, 5.1.0, and 6.2.0. If user-supplied input was passed into append/override_content_security_policy_directives, a semicolon could be injected leading to directive injection. This could b...
CVE-2020-5223
PUBLISHED: 2020-01-23
In PrivateBin versions 1.2.0 before 1.2.2, and 1.3.0 before 1.3.2, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability. The vulnerability has been fixed in PrivateBin v1.3...
CVE-2019-20399
PUBLISHED: 2020-01-23
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
CVE-2020-7915
PUBLISHED: 2020-01-22
An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.