Unfortunately no one can be told what fun_plug is - you have to see it for yourself.
You are not logged in.
I am just in the beginning stages of understanding the bash bug, and how it does or does not affect things, in particular, SSH.
I do run sshd on my DNS-323, open to the Net. Authentication is via RSA public key.
Questions:
======
1) From everything I read, it ~seems~ like ordinary ssh usage, without executing any fancy stuff using ForceCommand, ~~should~~ be unaffected by Shellshock. Am I off on my understanding?
2) My sshd is provided by fonz's fun plug. Is there a way to find out if/when a patch might come through for the bash version in ffp (think it's like 4.1.11)? Does fonz or somebody else still support this?
Thanks,
-Mike
Offline
1) From everything I read, it ~seems~ like ordinary ssh usage, without executing any fancy stuff using ForceCommand, ~~should~~ be unaffected by Shellshock. Am I off on my understanding?
No. Yes.
For ordinary ssh usage, there is no problem at all. You will get a shell, and can execute any command you like. It doesn't matter if there are other fancy ways to execute the same commands.
If you are using ForceCommand, then you are restricting users in what they can execute. Actually they can execute just a single command, the forced one. In that case it becomes a problem if another command can be injected.
Offline
There's many other way shellshock hurt a nas.
It can use a cgi to directly inject the command or simply inject the command through any http header (like the useragent string).
There's worm running right now targetting NAS.
if your nas admin is open on internet, I would be worried.
I can imagine other ways like BT to inject the command or through any other applications (DNS, DHCP, Mail, FTP, etc.)
There's some proof on how the vulnerability can be exploited there : https://github.com/mubix/shellshocker-pocs
Offline
Only port I have open to the outside is SSH, on a non-standard port w/ shared key authen, no ForceCommand or authorized_keys commands.
I still haven't heard if ffp would be patched to fix Shellshock, but it seems like for what I'm using this NAS for, it shouldn't really matter.
Offline
That might be a problem only with restricted accounts (git only, sftp, forcecommand, command=)
Offline
Hey, one another thing I'll chime in on regarding patching bash for the DNS-323. I realized that there is also the opportunity through ffp to install the optware tool kit. It's also not difficult to swap out the default or ffp login shell and insert the bash that can be imported using optware. It seems that the bash bundled with DNS-323's optware has already been patched for Shellshock. So, rather than wait for ffp's bash to be patched, which may never happen, one can switch to the optware version and get the current patch, and hopefully any more that come from upstream.
Offline
My sshd is provided by fonz's fun plug. Is there a way to find out if/when a patch might come through for the bash version in ffp (think it's like 4.1.11)? Does fonz or somebody else still support this?
From everything I read, it ~seems~ like ordinary ssh usage, without executing any fancy stuff using ForceCommand, ~~should~~ be unaffected by Shellshock. Am I off on my understanding?
Thanks,
translation services uk
Last edited by jacksjack (2014-11-24 11:44:41)
Offline