oss-sec mailing list archives
Re: CVE-2014-6271: remote code execution through bash
From: "Larry W. Cashdollar" <larry0 () me com>
Date: Thu, 25 Sep 2014 11:53:41 -0400
Hello List, A colleague of mine added an ifdef for FUNCTION_EXPORT, his modifications can be found here: https://github.com/akamai/bash/commit/7caac6ee41f645fc21b6e5eddc820151f6e6c43c Thank you. — Larry C$ On Sep 24, 2014, at 9:30 PM, Solar Designer <solar () openwall com> wrote:
On Wed, Sep 24, 2014 at 06:26:53PM -0700, Anthony Liguori wrote:On Wed, Sep 24, 2014 at 6:23 PM, Chet Ramey <chet.ramey () case edu> wrote:On 9/24/14, 5:32 PM, Solar Designer wrote:On Wed, Sep 24, 2014 at 11:27:09PM +0200, Hanno B??ck wrote:Tavis Ormandy just tweetet this: https://twitter.com/taviso/status/514887394294652929 The bash patch seems incomplete to me, function parsing is still brittle. e.g. $ env X='() { (a)=>\' sh -c "echo date"; cat echoThanks for bringing this to oss-security. I've added CC to Chet and Tavis on this "reply".I have a fix for this.Can you provide a pointer to the patch? I put together a patch that changed the report_error() to fatal_error() as I wasn't able to see how to reset the parser state. Was just about to send it out...I think Chet is not on oss-security - we should be CC'ing him where appropriate. (I've added the CC on this reply.) Alexander
Current thread:
- Re: CVE-2014-6271: remote code execution through bash, (continued)
- Re: CVE-2014-6271: remote code execution through bash John Haxby (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Michal Zalewski (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Simon McVittie (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash John Haxby (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Simon McVittie (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Simon McVittie (Sep 26)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 25)
- Message not available
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Alexandre Dulaunoy (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Larry W. Cashdollar (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Dwayne Litzenberger (Sep 26)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 26)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 26)