oss-sec mailing list archives
Re: Stéphane Chazelas: How *DID* you find Shellshock?
From: "stephane.chazelas" <stephane.chazelas () gmail com>
Date: Wed, 8 Oct 2014 16:11:22 +0100
2014-10-08 10:26:21 -0400, David A. Wheeler:
This is a question for Stéphane Chazelas, but I'm "cc"ing oss-security because I think many of us want to know the answer. Stéphane: How *DID* you find Shellshock, in as much detail as you can recall? I'm told you found the bug after "reflecting on an earlier bug" you found in bash "a few months earlier." (http://www.smh.com.au/it-pro/security-it/stephane-chazelas-the-man-who-found-the-webs-most-dangerous-internet-security-bug-20140927-10mixr.html) What I'm hoping is that we can learn some lessons and re-apply them elsewhere.
[...] That's something I've been asked often and all the journalists have transformed what I said. In any case, I didn't find the bug by observing exploits, I have no reason to beleive it's been exploited before being disclosed (though of course I can't rule it out). I did not find it by looking at bash's code either. some copy-pasting of what I've said to others: In July, I had found a vulnerability in the GNU libc (not bash) related to environment variables (CVE-2014-0475). It could be network exploitable with one particular vector: the bypass of OpenSSH's ForceCommand (used for instance in git servers or poor-man's VPNs). And it was agravated by a poor design choice of bash [(actually two: the parsing of .bashrc over ssh and the locale dependant parsing (that latter one not specific to bash))] which again could cause arbitrary command execution if enough conditions were met (a very narrow attack surface compared to shellshock). Again, that was not following any observation of an exploit attempt, just a reflection on a mechanism I knew about. I put that attack vector in context with that little known feature of bash, the exporting/importing of functions for which I already knew part of the mechanism. Started to think of the possible way it was implemented, thought that it could very well be the very simplest way, in which case that was a big security hole. More details at http://thread.gmane.org/gmane.comp.shells.bash.bugs/22367 Which I've just posted. and: http://thread.gmane.org/gmane.comp.shells.bash.bugs/22096 -- Stephane
Current thread:
- Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash), (continued)
- Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Riot (Oct 03)
- Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Stephane Chazelas (Oct 04)
- Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Hanno Böck (Oct 04)
- Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Steve Jones (Oct 04)
- Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Lance Davis (Oct 04)
- Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) David A. Wheeler (Oct 05)
- Re: Shellshock timeline (was: CVE-2014-6271: remote code execution through bash) Eric Blake (Oct 06)
- Re: Shellshock timeline Stephane Chazelas (Oct 03)
- Stéphane Chazelas: How *DID* you find Shellshock? David A. Wheeler (Oct 08)
- Re: Stéphane Chazelas: How *DID* you find Shellshock? stephane.chazelas (Oct 08)
- Re: Shellshock timeline Eric Blake (Oct 03)