Current Intel on BashBug / Shellshock

CVEs
CVE-2014-6271  (1st bug report)
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

CVE-2014-7169   (2nd bug/variant, aka AfterShock)
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7169
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

CVE-2014-7186   (3rd bug/variant found by Redhat's Florian Weimer)
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7186
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.

CVE-2014-7187    (4th bug/variant found by Redhat's Florian Weimer)
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7187
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.

CVE-2014-6277   (5th bug/variant found by Google's Michael Zalewski)
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-627
Variant 1. GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.

CVE-2014-6278   (6th bug/variant found by Google's Michael Zalewski)
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6278   (reserved, not available yet)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278
Variant 2. (see Variant 1 CVE-2014-6277 for a description)

From SANS Advisory Board: Only the first two listed above are patched in “main stream” linux distros. A source code patch is available for the rest if you want to compile bash yourself, but exploitation is a tad harder for the last 4.

Other Info
GNU Patch Info
List for current bash (4.3): http://ftp.gnu.org/gnu/bash/bash-4.3-patches/
Latest bash patch (027): http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027

Botnets

• wopbot: http://www.itnews.com.au/News/396197,first-shellshock-botnet-attacks-akamai-us-dod-networks.aspx
• bashlite: http://blog.trendmicro.com/trendlabs-security-intelligence/shellshock-updates-bashlite-ccs-seen-shellshock-exploit-attempts-in-brazil/

Network Detection (IDS, IPS, WAF)

• VRT and EmergingThreats posts showing this is being addressed for Snort
• ...

Exploits

• My testing showed it's easy to attack using the given test strings, simply by using them directly in HTTP headers such as Cookie and User-Agent.
• See also https://www.fishnetsecurity.com/6labs/blog/shellshock-vulnerability-bash-allows-unauthorized-remote-code-execution

Bash Test Strings
Command line tests to verify proper patching (and to somehow use in our detections):

• Early patch: env x='() { :;}; echo Not patched' bash -c "echo This is a test."
• Later patch: foo='() { echo Not patched; }' bash -c foo
• (search for more...)