oss-sec mailing list archives
Re: Healing the bash fork
From: Sebastian Krahmer <krahmer () suse de>
Date: Tue, 30 Sep 2014 16:07:31 +0200
Hi On Tue, Sep 30, 2014 at 08:41:24AM -0500, Kobrin, Eric wrote:
"innocuous looking setuid program" made my day ;)We should take care not to blame all and everything to bash.I don't find that blame is a useful tool for fixing security problems. What's more interesting to me is: what system components are in a position to help. If a change in bash can make a bunch of "innocuous looking setuid programs" not be vectors for the import of malicious functions, let's do it.
In no shell-universe setreuid(0, 0); system("date"); is an "innocuous looking setuid program". It fails in so many ways that I cant enumerate it here, despite missing sanity checks for readability and in that suids must not use system() or popen() in the first place. If one finds a construct in code that looks similar to this, fix it. Really. No bash update (and no other shell) will ever make this secure. If we start fixing the underlying system so that above code is innocuous indeed, rather than fixing the programmers producing such code, our road ends at php. Sebastian -- ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer () suse de - SuSE Security Team
Current thread:
- Re: Healing the bash fork Mark R Bannister (Sep 30)
- <Possible follow-ups>
- Re: Healing the bash fork Sven Kieske (Sep 30)
- Re: Healing the bash fork Mark R Bannister (Sep 30)
- Re: Healing the bash fork Sebastian Krahmer (Sep 30)
- Re: Healing the bash fork Kobrin, Eric (Sep 30)
- Re: Healing the bash fork Sebastian Krahmer (Sep 30)
- Re: Healing the bash fork John Haxby (Sep 30)
- Re: Healing the bash fork Ed Prevost (Sep 30)
- Re: Healing the bash fork Rich Felker (Sep 30)
- Re: Healing the bash fork Kobrin, Eric (Sep 30)
- Re: Healing the bash fork Michal Zalewski (Sep 30)
- Re: Healing the bash fork Simon McVittie (Sep 30)
- Re: Healing the bash fork Mark R Bannister (Sep 30)
- Re: Healing the bash fork Tavis Ormandy (Sep 30)
- Re: Healing the bash fork Ed Prevost (Sep 30)
- Re: Healing the bash fork Zach Wikholm (Sep 30)
- Re: Healing the bash fork David A. Wheeler (Sep 30)
- Re: Healing the bash fork Ed Prevost (Sep 30)