Re: CVE-2014-6271: remote code execution through bash

[Chet Ramey <chet.ramey () case edu>]

On 9/24/14, 12:01 PM, Alexander E. Patrakov wrote:

> > I see no good workaround.  Starting the forced command with "unset
> > SSH_ORIGINAL_COMMAND &&" does not help - we'd need to unset the variable
> > before starting bash, not from bash.
>
> Won't installing dash and setting the shell of users who have forced
> commands to dash mitigate this somehow?

Why not install the publicly-available bash patches and rebuild bash?
That's the real solution.

-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet () case edu    http://cnswww.cns.cwru.edu/~chet/