<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div><span>Hello Chircu,</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal;"><br><span></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal;"><span>thanks for the information.</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal;"><br><span></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida
Grande,sans-serif; background-color: transparent; font-style: normal;"><span>regards</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal;"><br><span></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue,Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; background-color: transparent; font-style: normal;"><span>Jens Sauer</span></div> <div class="qtdSeparateBR"><br><br></div><div style="display: block;" class="yahoo_quoted"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 12px;"> <div dir="ltr"> <font face="Arial" size="2"> Liviu Chircu <liviu@opensips.org> schrieb am 20:56 Mittwoch,
1.Oktober 2014:<br> </font> </div> <br><br> <div class="y_msg_container"><div id="yiv0184121592">
<div>
<tt>Hello all,<br>
<br>
The following email addresses a serious security issue (10/10 note
on severity) which may/may not affect existing<br>
OpenSIPS-based platforms. [1]<br>
<br>
The issue was disclosed in September and is commonly named
"Shellshock". You can read all about it on Wikipedia [2].<br>
Long story short, it is a GNU Bash vulnerability in the code which
handles environment variables.<br>
<br>
It also seems that under the "right conditions", any version of an
OpenSIPS server can be vulnerable to this exploit.<br>
<br>
The following are the "right conditions":<br>
* your /bin/sh is vulnerable to Shellshock. You can test this
with the following command:<br>
env x='() { :;}; echo vulnerable' bash -c 'echo this is a
test'<br>
* your OpenSIPS uses the "exec" module<br>
* you have not disabled the "setvars" modparam of exec [3]<br>
<br>
If <b>all</b> of the above conditions are true, then you are
vulnerable to some cleverly crafted INVITE requests. An attacker<br>
could remotely execute code with the privileges of your OpenSIPS
daemon user!<br>
<br>
Ways to fix the issue (<b>any</b> of them is enough):<br>
* upgrade your bash shell to a non-vulnerable version<br>
* if you are not using the environment variables in your exec
scripts, then skip them:<br>
modparam("exec", "setvars", 0)<br>
<br>
Note on broken backwards-compatibility:<br>
We have disabled the "setvars" parameter by default in all
supported OpenSIPS versions. If you were using the<br>
environment variables in your exec scripts, make sure you update
your OpenSIPS script and bash shell after<br>
performing an upgrade to the daily OpenSIPS builds.<br>
<br>
[1]: <a rel="nofollow" class="yiv0184121592moz-txt-link-freetext" target="_blank" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271</a><br>
[2]: <a rel="nofollow" class="yiv0184121592moz-txt-link-freetext" target="_blank" href="http://en.wikipedia.org/wiki/Shellshock_(software_bug)">http://en.wikipedia.org/wiki/Shellshock_(software_bug)</a><br>
[3]:
<a rel="nofollow" class="yiv0184121592moz-txt-link-freetext" target="_blank" href="http://www.opensips.org/html/docs/modules/1.12.x/exec.html#id248413">http://www.opensips.org/html/docs/modules/1.12.x/exec.html#id248413</a><br>
<br>
Best regards,<br>
</tt>
<pre class="yiv0184121592moz-signature">--
Liviu Chircu
OpenSIPS Developer
<a rel="nofollow" class="yiv0184121592moz-txt-link-freetext" target="_blank" href="http://www.opensips-solutions.com/">http://www.opensips-solutions.com</a></pre>
</div>
</div><br>_______________________________________________<br>Users mailing list<br><a ymailto="mailto:Users@lists.opensips.org" href="mailto:Users@lists.opensips.org">Users@lists.opensips.org</a><br><a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br><br><br></div> </div> </div> </div> </div></body></html>