RE: Shellshocker - Repository of "Shellshock" Proof of Concept Code

[Sona Sarmadi <sona.sarmadi () enea com>]

> > < https://github.com/mubix/shellshocker-pocs >
>
> I mentioned this earlier on another thread, but I would really warn people
> about relying on this unless they really understand what's going on.
>
> /mz

Thanks Michal, 

I agree that everyone using bash needs to understand what is going on,  but I think what most (non-expert) people need 
is an explanation for each CVE, a set of test case from some reliable source (preferably a script that runs all test 
cases and shows vulnerable/not-vulnerable status) and a set of patches. So that they can apply the patches, run the 
tests and assert that their systems are not vulnerable to shellshock anymore.

Maybe we should update your summary like this:

    CVE-2014-6271 - original RCE found by Stephane. Fixed by bash43-025 and corresponding Sep 24 entries for other 
versions.
    CVE-2014-7169 - file creation / token consumption bug found by Tavis. Fixed by bash43-026 & co (Sep 26)
    CVE-2014-7186 - a probably no-sec-risk 10+ here-doc crash found by Florian and Todd. Fixed by bash43-028 & co (Oct 
1).
    CVE-2014-7187 - a non-crashing, probably no-sec-risk off-by-one found by Florian. Fixed by bash43-028 & co (Oct 1).
    CVE-2014-6277 - uninitialized memory issue, almost certainly RCE found by me. Fixed by bash43-029 & co (Oct 2).
    CVE-2014-6278 - command injection RCE found by me. (No specific patch yet, maybe bash43-30 ??).


Some questions:
 1) bash43-027   patch  exported function namespace change,  Florian's mitigation patch that shields the parser from 
untrusted inputs". This does not solve any specific CVE, but mitigates all CVEs, is this correct?

2) Do we need to apply *all* of these individual bash patches (i.e. bash43-025 through bash43-029)? Even  bash43-027 
which is not solving any specific CVE?  Or should we apply 27 or all the others?

3) Do you have a script or summary of all tests in one place like  
http://en.wikipedia.org/wiki/Shellshock_%28software_bug%29 or 
https://raw.githubusercontent.com/hannob/bashcheck/master/bashcheck ? Or maybe these are good enough & reliable? 

Thanks
/Sona