oss-sec mailing list archives
Re: CVE-2014-6271: remote code execution through bash
From: Michal Zalewski <lcamtuf () coredump cx>
Date: Wed, 24 Sep 2014 11:54:18 -0700
My main concern with the current patch is that still exposes the bash parser and function definition printer to attacks from the network. Bugs in those fairly large components could cause another critical issue.
Yup, that surprised me when testing the patch, too - I can still get a function called HTTP_COOKIE, for example. I worry about potential side effects of parsing even in absence of parser bugs. In most object-oriented languages, such side effects are practically guaranteed. Bash may be saved by simplicity, but not sure how robust that assumption is. I've written more code in bash than I should have and never used function exports, or even realized that they exist. I wonder if they can be made optional (e.g., gated by a flag on the subprocess) without breakage. Another option may be to export them through specially prefixed variables, which should be transparent but minimize the risk of interfering with web servers and such. /mz
Current thread:
- Re: CVE-2014-6271: remote code execution through bash, (continued)
- Re: CVE-2014-6271: remote code execution through bash Florian Weimer (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Pierre Schweitzer (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash gremlin (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Jason Cooper (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Jason Cooper (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Jason Cooper (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Michal Zalewski (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Huzaifa Sidhpurwala (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 26)
- Re: CVE-2014-6271: remote code execution through bash David A. Wheeler (Sep 26)
- Message not available
- Message not available
- Message not available
- Message not available
- Message not available
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 27)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 27)