Re: CVE-2014-6271: remote code execution through bash

[Chet Ramey <chet.ramey () case edu>]

On 9/24/14, 5:32 PM, Solar Designer wrote:
> On Wed, Sep 24, 2014 at 11:27:09PM +0200, Hanno B??ck wrote:
> > Tavis Ormandy just tweetet this:
> > https://twitter.com/taviso/status/514887394294652929
> >
> > The bash patch seems incomplete to me, function parsing is still
> > brittle. e.g. $ env X='() { (a)=>\' sh -c "echo date"; cat echo
>
> Thanks for bringing this to oss-security.  I've added CC to Chet and
> Tavis on this "reply".

I have a fix for this.

Chet
-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet () case edu    http://cnswww.cns.cwru.edu/~chet/