Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

9/26/2014
05:00 PM
50%
50%

Apple: Majority Of Mac OS X Users Not At Risk To 'Shellshock'

According to Apple, Mac OS X systems are not exposed to remote exploits of Bash unless users have certain UNIX services configured.

Apple says the so-called Shellshock bug does not impact the majority of Mac OS X users.

That may come as a bit of good news for Apple customers worried about the newly revealed vulnerability affecting GNU's Bourne Again Shell (Bash).

"The vast majority of OS X users are not at risk to recently reported Bash vulnerabilities," an Apple spokesperson told Dark Reading. "Bash, a UNIX command shell and language included in OS X, has a weakness that could allow unauthorized users to remotely gain control of vulnerable systems. With OS X, systems are safe by default and not exposed to remote exploits of Bash unless users configure advanced UNIX services. We are working to quickly provide a software update for our advanced UNIX users."

Apple did not specify what "advanced services" it meant. Eldon Sprickerhoff, chief security strategist at eSentire says they likely include "inbound services including ssh, web services (a.k.a. Apache)," and others. "My advice is, if you're running OS X as a web server, take it down until there's a patch or use something to block ShellShockish queries with a wrapper or something like Mod-security."

The vast majority of the attacks inbound on the Internet are through web servers, he says. "You use the web server to run a script that lets you exploit the bash bug. The web server is the vector to access the bug itself. So, if you have fewer open vectors available, you're less vulnerable. However, there's some indication that DHCP could be a vector for other systems. There's a whole new attack space to be analyzed here."

The Pluralsight author and security expert Troy Hunt wrote in a blog post that Bash is a *nix shell -- an interpreter that enables users to orchestrate commands on Unix and Linux systems, typically by connecting over SSH or Telnet. It can also operate as a parser for CGI scripts on a web server that would typically be seen running on Apache.

"There are other shells out there for Unix variants, the thing about Bash though is that it's the default shell for Linux and Mac OS X which are obviously extremely prevalent operating systems," he wrote. "That's a major factor in why this risk is so significant -- the ubiquity of Bash -- and it's being described as 'one of the most installed utilities on any Linux system.'"

The risk centers on "the ability to arbitrarily define environment variables within a Bash shell which specify a function definition," Hunt wrote. "The trouble begins when Bash continues to process shell commands after the function definition resulting in what we'd classify as a 'code injection attack.'"

Shortly after the bug was disclosed yesterday, the first attempts by criminals to take advantage of the issue began.

"The most recent attempts we see to gain control of web servers just create a new instance of Bash and redirect it to a remote server listening on a specific TCP port. This is also known as a reverse-connect-shell," Kaspersky Lab's Stefan Ortloff wrote in a blog post today. "In another ongoing attack the criminals are using a specially crafted HTTP-request to exploit the Bash vulnerability in order to install a Linux-backdoor on the victim's server. We're detecting the malware and its variants as Backdoor.Linux.Gafgyt."

The activity by attackers has led the Internet Storm Center to raise the 'InfoCon' status to Yellow.

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
9/30/2014 | 2:38:52 AM
Re: Apple is attempting to minimize.
I agree theb0x!
theb0x
50%
50%
theb0x,
User Rank: Ninja
9/29/2014 | 9:26:22 PM
Re: Apple is attempting to minimize.
The following conditions must be true in OSX to exploit the system:

1) Root must be enabled. The setting is pretty well hidden and the user must knowly access it. (System default is disabled in latest OSX.)

2) A local terminal session must be spawned with the following command followed by root password:

sudo systemsetup -setremotelogin on

This enables the SSH Daemon. How many average Apple users do you think have configured their systems this way? At this point I see this as nothing more than a social engineering attack for these system conditions to be true for most users. Unless they know what SSH is because they're a Sys Admin. I am not taking sides with Apple. Their security responses are a joke and always make me chuckle.
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
9/29/2014 | 11:02:09 AM
Re: Apple is attempting to minimize.
I agree, OS X is anyway affected by the Bash bug flaw and its announcement is giving a fake sense of security to many people that aren't able to check their systems.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
9/29/2014 | 9:12:11 AM
Re: Apple is attempting to minimize.
Very good point Robert. I think even if there is the possibility of a vulnerable configuration within your hardware that you need to account for it. How difficult would it be for Apple to design a quick app to check if the system settings you have on your Mac are vulnerable? 

The answer is not very difficult at all if it is just a series of enables/disables. If enabled true if not than false. A quick scan should be made available for all OSX users. I think it isn't too lofty of a request considered that this vulnerability was given the highest severity rating possible by NIST.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
9/28/2014 | 12:48:25 PM
Apple is attempting to minimize.
True, in order to be vulnerable to a remote execution you need to enable some inbound service, such as SSH.  However, the fact is that ALL versions of OSX have the vulnerability.  In my testing, every version of OSX, including the beta of Yosemite, have proved to be vulnerable.

I know Apple hasn't had to deal with major vulnerabilities routinely in the past, but this isn't the way to address it.  Apple should admit that all versions of OSX have the vulnerability but, users are not exposed unless they enable X, Y or Z.  They shouldn't leave the subject up for debate by making a nebulous statement such as "systems are safe by default and not exposed to remote exploits of Bash unless users configure advanced UNIX services".  This doesn't actually explain to users how they might currently be vulnerable, or what they may do for a work around.

Apple gets an F for this response in my book.

 
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15113
PUBLISHED: 2019-08-16
The companion-sitemap-generator plugin before 3.7.0 for WordPress has CSRF.
CVE-2019-15114
PUBLISHED: 2019-08-16
The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.
CVE-2019-15115
PUBLISHED: 2019-08-16
The peters-login-redirect plugin before 2.9.2 for WordPress has CSRF.
CVE-2019-15116
PUBLISHED: 2019-08-16
The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.
CVE-2017-18547
PUBLISHED: 2019-08-16
The nelio-ab-testing plugin before 4.6.4 for WordPress has CSRF in experiment forms.