Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


43 posts

Geek
+1 received by user: 8


Topic # 153472 27-Sep-2014 22:24
Send private message

I have a ONT and a router provided by telecom for my fibre connection, are they vulnerable to the Shellshock bug?

I couldn't find any information on Spark's website.

Create new topic
2090 posts

Uber Geek
+1 received by user: 848


  Reply # 1142883 28-Sep-2014 09:28
One person supports this post
Send private message

Are either actually accessible to the internet?

You need a process that is internet accessible (apache etc) for it to actually be an issue externally.



43 posts

Geek
+1 received by user: 8


  Reply # 1142884 28-Sep-2014 09:32
Send private message

wasabi2k: Are either actually accessible to the internet?

You need a process that is internet accessible (apache etc) for it to actually be an issue externally.


i don't run web servers or anything but I do run things like BitTorrent and have configured port forwarding on the router, does that matter?

BDFL - Memuneh
60807 posts

Uber Geek
+1 received by user: 11689

Administrator
Trusted
Geekzone
Lifetime subscriber

  Reply # 1142885 28-Sep-2014 09:42
One person supports this post
Send private message


43 posts

Geek
+1 received by user: 8


  Reply # 1142887 28-Sep-2014 09:46
Send private message

freitasm: He's asking if those processes run on the modem/router itself.


thanks.

No, the BT client runs on a Windows machine, the router only does port forwarding.

4025 posts

Uber Geek
+1 received by user: 1076

Trusted

  Reply # 1142926 28-Sep-2014 12:35
One person supports this post
Send private message

My Guess: Probably not. Most embedded devices in the modem/router category don't tend to run full bash, they tend to run busybox due to its small footprint.
Of course there are exceptions to this, which is why this bug is a problem even for embedded devices.

If you can get a telnet or ssh session open, use bash --version or echo $BASH_VERSION to see if you have it

3209 posts

Uber Geek
+1 received by user: 616

Trusted

  Reply # 1143005 28-Sep-2014 16:11
2 people support this post
Send private message

I'd be more worried about the dynalink routers that a certain ~4th largest ISP in the country was sending out to customers for about 5 years with admin/admin credentials and the port 80 web admin accessible on the WAN interface, with the DSL username and password in plaintext on the ppp settings page sourcecode.




Ray Taylor
Taylor Broadband (rural hawkes bay)
www.ruralkiwi.com

There is no place like localhost
For my general guide to extending your wireless network Click Here




'That VDSL Cat'
8103 posts

Uber Geek
+1 received by user: 1693

Trusted
Spark
Subscriber

  Reply # 1143006 28-Sep-2014 16:13
Send private message

raytaylor: I'd be more worried about the dynalink routers that a certain ~4th largest ISP in the country was sending out to customers for about 5 years with admin/admin credentials and the port 80 web admin accessible on the WAN interface, with the DSL username and password in plaintext on the ppp settings page sourcecode.


dlinks were bad for this too :/




#include <std_disclaimer>

 

Any comments made are personal opinion and do not reflect directly on the position my current or past employers may have.




43 posts

Geek
+1 received by user: 8


  Reply # 1143174 28-Sep-2014 22:07
Send private message

eXDee: My Guess: Probably not. Most embedded devices in the modem/router category don't tend to run full bash, they tend to run busybox due to its small footprint.
Of course there are exceptions to this, which is why this bug is a problem even for embedded devices.

If you can get a telnet or ssh session open, use bash --version or echo $BASH_VERSION to see if you have it

thanks for he information.

I didn't have luck getting telnet or ssh to work, I can get a telnet session but the user/password from the web interface doesn't work for telnet, ssh doesn't even connect.

Create new topic

Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Hawaiki Transpacific cable ready-for-service
Posted 20-Jul-2018 11:29


Microsoft Dynamics 365 Business Central launches
Posted 10-Jul-2018 10:40


Spark completes first milestone in voice platform upgrade
Posted 10-Jul-2018 09:36


Microsoft ices heated developers
Posted 6-Jul-2018 20:16


PB Technologies charged for its extended warranties and warned for bait advertising
Posted 3-Jul-2018 15:45


Almost 20,000 people claim credits from Spark
Posted 29-Jun-2018 10:40


Cove sells NZ's first insurance policy via chatbot
Posted 25-Jun-2018 10:04


N4L helping TAKA Trust bridge the digital divide for Lower Hutt students
Posted 18-Jun-2018 13:08


Winners Announced for 2018 CIO Awards
Posted 18-Jun-2018 13:03


Logitech Rally sets new standard for USB-connected video conference cameras
Posted 18-Jun-2018 09:27


Russell Stanners steps down as Vodafone NZ CEO
Posted 12-Jun-2018 09:13


Intergen recognised as 2018 Microsoft Country Partner of the Year for New Zealand
Posted 12-Jun-2018 08:00


Finalists Announced For Microsoft NZ Partner Awards
Posted 6-Jun-2018 15:12


Vocus Group and Vodafone announce joint venture to accelerate fibre innovation
Posted 5-Jun-2018 10:52


Kogan.com to launch Kogan Mobile in New Zealand
Posted 4-Jun-2018 14:34



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.