oss-sec mailing list archives
Re: CVE-2014-6271: remote code execution through bash
From: Chet Ramey <chet.ramey () case edu>
Date: Thu, 25 Sep 2014 11:37:45 -0400
On 9/24/14, 10:47 PM, Solar Designer wrote:
On Wed, Sep 24, 2014 at 03:12:08PM -0400, Chet Ramey wrote:There are several options for making shell functions inherited via the environment more robust, none of them backwards compatible. I will choose one and implement it for a future bash version.While we're at it, I think it's preferable not to output error messages triggerable by untrusted input, e.g.: $ ssh -o 'rsaauthentication yes' 0 '() { ignored; }; /usr/bin/id' bash: warning: SSH_ORIGINAL_COMMAND: ignoring function definition attempt bash: error importing function definition for `SSH_ORIGINAL_COMMAND' (as seen with the current bash patches). This might be unnecessarily revealing or/and it might confuse whatever other program was invoking something via bash, resulting in attacker-triggerable unintended behavior in that caller program. Yes, there are numerous other error conditions anyway - such as running out of memory - which may result in messages printed to stderr. Yet we might want to avoid printing error messages for environment variable value parsing errors (ideally, we'd avoid the parsing itself as well), unless a debugging or a verbose mode is enabled locally (in a way that can't realistically be triggered via an unsuspecting network service).
I disagree. It's important for a program -- not just the shell -- to tell the user when it attempts to do something on his behalf and is unable to do it. Chet -- ``The lyf so short, the craft so long to lerne.'' - Chaucer ``Ars longa, vita brevis'' - Hippocrates Chet Ramey, ITS, CWRU chet () case edu http://cnswww.cns.cwru.edu/~chet/
Current thread:
- Re: Healing the bash fork, (continued)
- Re: Healing the bash fork gremlin (Sep 29)
- Re: Healing the bash fork Florian Weimer (Sep 30)
- Re: Healing the bash fork Gennady Kupava (Sep 30)
- Re: Healing the bash fork gremlin (Sep 30)
- Re: Healing the bash fork Kobrin, Eric (Sep 29)
- Re: Healing the bash fork Michal Zalewski (Sep 29)
- Re: Healing the bash fork Kobrin, Eric (Sep 30)
- Re: Re: Healing the bash fork Todd C. Miller (Sep 29)
- atd (was: Re: [oss-security] Re: Healing the bash fork) Seth Arnold (Sep 29)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Christos Zoulas (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Tavis Ormandy (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Michal Zalewski (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Florian Weimer (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 24)