So this was not a relaxing weekend.
By now if you run so much as a Raspberry Pi you've heard about Shellshock, the bash vulnerability that got disclosed last Wednesday (the 24th) and immediately turned into the kind of thing where every sysadmin I know just sort of quietly disappeared from Twitter for 48 hours. CVE-2014-6271 is the original one, and then a day later there was a second patch for CVE-2014-7169 because the first fix wasn't actually complete. That part still bugs me a little - the first "fix" that got shipped Thursday didn't fully close the hole, so a bunch of us ended up patching twice in three days.
I run this blog off a $5/month DigitalOcean droplet (yes, the same one since early 2013, I should really upgrade it at some point) and I also still babysit a couple of WordPress installs for my aunt's knitting supply shop and an old college friend's photography portfolio. All three run Ubuntu with bash doing CGI-ish things behind the scenes, which is exactly the setup thats vulnerable. The test is stupidly simple, you just run this in a terminal:
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
If it prints "vulnerable" before "this is a test," you've got a problem. Two of my three boxes printed it Thursday morning. Fun.
The actual fix was just apt-get update && apt-get install --only-upgrade bash, which took maybe four minutes per server, so the technical part wasnt the hard part. The hard part was that I didnt actually know how many things touched bash on these boxes until I went looking. Cron jobs, a couple of ancient PHP scripts that shell out to ImageMagick, some git hooks I forgot I even wrote. Its the kind of bug that makes you realize how much of your own infrastructure you've never actually audited, because it was working fine and you had no reason to look.
The genuinely annoying part was my friend's shared hosting company (I wont name them, but if you're paying six bucks a month for hosting somewhere and havent heard a word from your host about this, go check your own bash version right now). Her account was still vulnerable as of Friday night. I ended up writing a wrapper script around the CGI handler to sanitize incoming env vars as a stopgap until they got around to fixing it, which is not how I wanted to spend my Friday night, but here we are.
Small tangent, but Apple also had a rough week, completely unrelated except in the sense that late September 2014 was apparently just A Week For Bugs. They shipped iOS 8.0.1 on Wednesday and it broke cellular service and Touch ID on the new 6 and 6 Plus, and they pulled the update within about an hour of people installing it. I didnt get bit because Ive gotten cautious enough to wait a day or two before installing point releases on my phone, which past-me would've called paranoid and current-me calls having learned my lesson. My phone's still sitting on plain 8.0 and Im in no hurry to change that.
Anyway. If youre running any Linux box with bash on it - a VPS, a NAS, an old router with a shell dropped into it, whatever - and you havent checked it since last Wednesday, stop reading this and go run that test command above. It takes ten seconds. Im not going to pretend patching bash versions is glamorous writing material but Id rather spend a paragraph on ten seconds of prevention than spend an afternoon explaining to my aunt why her shop's website got compromised.