<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<tt>Hello all,<br>
<br>
The following email addresses a serious security issue (10/10 note
on severity) which may/may not affect existing<br>
OpenSIPS-based platforms. [1]<br>
<br>
The issue was disclosed in September and is commonly named
"Shellshock". You can read all about it on Wikipedia [2].<br>
Long story short, it is a GNU Bash vulnerability in the code which
handles environment variables.<br>
<br>
It also seems that under the "right conditions", any version of an
OpenSIPS server can be vulnerable to this exploit.<br>
<br>
The following are the "right conditions":<br>
* your /bin/sh is vulnerable to Shellshock. You can test this
with the following command:<br>
env x='() { :;}; echo vulnerable' bash -c 'echo this is a
test'<br>
* your OpenSIPS uses the "exec" module<br>
* you have not disabled the "setvars" modparam of exec [3]<br>
<br>
If <b>all</b> of the above conditions are true, then you are
vulnerable to some cleverly crafted INVITE requests. An attacker<br>
could remotely execute code with the privileges of your OpenSIPS
daemon user!<br>
<br>
Ways to fix the issue (<b>any</b> of them is enough):<br>
* upgrade your bash shell to a non-vulnerable version<br>
* if you are not using the environment variables in your exec
scripts, then skip them:<br>
modparam("exec", "setvars", 0)<br>
<br>
Note on broken backwards-compatibility:<br>
We have disabled the "setvars" parameter by default in all
supported OpenSIPS versions. If you were using the<br>
environment variables in your exec scripts, make sure you update
your OpenSIPS script and bash shell after<br>
performing an upgrade to the daily OpenSIPS builds.<br>
<br>
[1]: <a class="moz-txt-link-freetext" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271</a><br>
[2]: <a class="moz-txt-link-freetext" href="http://en.wikipedia.org/wiki/Shellshock_(software_bug)">http://en.wikipedia.org/wiki/Shellshock_(software_bug)</a><br>
[3]:
<a class="moz-txt-link-freetext" href="http://www.opensips.org/html/docs/modules/1.12.x/exec.html#id248413">http://www.opensips.org/html/docs/modules/1.12.x/exec.html#id248413</a><br>
<br>
Best regards,<br>
</tt>
<pre class="moz-signature" cols="72">--
Liviu Chircu
OpenSIPS Developer
<a class="moz-txt-link-freetext" href="http://www.opensips-solutions.com">http://www.opensips-solutions.com</a></pre>
</body>
</html>