bashcheck シェルスクリプトの動作について

Shellshock 検証用に、bashcheck というシェルスクリプトが公開されています。

https://github.com/hannob/bashcheck/blob/master/bashcheck

使い方は、bashcheck ファイルを chmod で実行可能にして以下のように実行するだけです。

$ ./bashcheck [another_bash]

最初の引数で別の bash が指定できます。省略すると標準の bash で、こちらの環境では /usr/local/bin/bash です。

これを利用して、patch 25 から patch 30 までの bash 毎に実行してみました。

Bash version 4.3.0(1)-release

Variable function parser active, maybe vulnerable to unknown parser bugs
Vulnerable to CVE-2014-6271 (original shellshock)
Vulnerable to CVE-2014-7169 (taviso bug)
Vulnerable to CVE-2014-7186 (redir_stack bug)
Test for CVE-2014-7187 not reliable without address sanitizer
Vulnerable to CVE-2014-6277 (lcamtuf bug #1)
Vulnerable to CVE-2014-6278 (lcamtuf bug #2)


Bash version 4.3.25(1)-release

Variable function parser active, maybe vulnerable to unknown parser bugs
Not vulnerable to CVE-2014-6271 (original shellshock)
Vulnerable to CVE-2014-7169 (taviso bug)
Vulnerable to CVE-2014-7186 (redir_stack bug)
Test for CVE-2014-7187 not reliable without address sanitizer
Vulnerable to CVE-2014-6277 (lcamtuf bug #1)
Vulnerable to CVE-2014-6278 (lcamtuf bug #2)


Bash version 4.3.26(2)-release

Variable function parser active, maybe vulnerable to unknown parser bugs
Not vulnerable to CVE-2014-6271 (original shellshock)
Not vulnerable to CVE-2014-7169 (taviso bug)
Vulnerable to CVE-2014-7186 (redir_stack bug)
Test for CVE-2014-7187 not reliable without address sanitizer
Vulnerable to CVE-2014-6277 (lcamtuf bug #1)
Vulnerable to CVE-2014-6278 (lcamtuf bug #2)


Bash version 4.3.27(3)-release

Variable function parser pre/suffixed [%%, upstream], bugs not exploitable
Not vulnerable to CVE-2014-6271 (original shellshock)
Not vulnerable to CVE-2014-7169 (taviso bug)
Found non-exploitable CVE-2014-7186 (redir_stack bug)
Test for CVE-2014-7187 not reliable without address sanitizer
Found non-exploitable CVE-2014-6277 (lcamtuf bug #1)
Found non-exploitable CVE-2014-6278 (lcamtuf bug #2)


Bash version 4.3.28(2)-release

Variable function parser pre/suffixed [%%, upstream], bugs not exploitable
Not vulnerable to CVE-2014-6271 (original shellshock)
Not vulnerable to CVE-2014-7169 (taviso bug)
Not vulnerable to CVE-2014-7186 (redir_stack bug)
Test for CVE-2014-7187 not reliable without address sanitizer
Found non-exploitable CVE-2014-6277 (lcamtuf bug #1)
Found non-exploitable CVE-2014-6278 (lcamtuf bug #2)


Bash version 4.3.29(3)-release

Variable function parser pre/suffixed [%%, upstream], bugs not exploitable
Not vulnerable to CVE-2014-6271 (original shellshock)
Not vulnerable to CVE-2014-7169 (taviso bug)
Not vulnerable to CVE-2014-7186 (redir_stack bug)
Test for CVE-2014-7187 not reliable without address sanitizer
Not vulnerable to CVE-2014-6277 (lcamtuf bug #1)
Found non-exploitable CVE-2014-6278 (lcamtuf bug #2)


Bash version 4.3.30(4)-release

Variable function parser pre/suffixed [%%, upstream], bugs not exploitable
Not vulnerable to CVE-2014-6271 (original shellshock)
Not vulnerable to CVE-2014-7169 (taviso bug)
Not vulnerable to CVE-2014-7186 (redir_stack bug)
Test for CVE-2014-7187 not reliable without address sanitizer
Not vulnerable to CVE-2014-6277 (lcamtuf bug #1)
Not vulnerable to CVE-2014-6278 (lcamtuf bug #2)


ちなみに、前回アップデートした pidora の /bin/bash はこのような結果です。


Bash version 4.2.48(1)-release

Variable function parser pre/suffixed [(), redhat], bugs not exploitable
Not vulnerable to CVE-2014-6271 (original shellshock)
Not vulnerable to CVE-2014-7169 (taviso bug)
Not vulnerable to CVE-2014-7186 (redir_stack bug)
Test for CVE-2014-7187 not reliable without address sanitizer
Not vulnerable to CVE-2014-6277 (lcamtuf bug #1)
Found non-exploitable CVE-2014-6278 (lcamtuf bug #2)


となって、4.3.29 とほぼ同じです。具体的には、以下のような別のテストでワーニングになっています。

(4.3.29)
# env BASH_FUNC_x%%='() { _;}>_[$($())] { echo x;}' /bad/bash43-29 -c :
x

(/bin/bash)
# env 'BASH_FUNC_x()'='() { _;}>_[$($())] { echo x;}' /bin/bash -c :
x

ちなみに、4.3.30 ではこのようになります。

# env BASH_FUNC_x%%='() { _;}>_[$($())] { echo x;}' bash -c :
bash: x: line 0: syntax error near unexpected token `{'
bash: x: line 0: `x () { _;}>_[$($())] { echo x;}'
bash: error importing function definition for `x'
#

# env 'BASH_FUNC_x()'='() { _;}>_[$($())] { echo x;}' bash -c :
#

shellshock を切っ掛けに bash の脆弱性のテストを Pidora で行ってきましたが、Raspberry Pi でも十分テストに利用できますね。