oss-sec mailing list archives
Re: CVE-2014-6271: remote code execution through bash
From: Solar Designer <solar () openwall com>
Date: Thu, 25 Sep 2014 21:31:41 +0400
On Thu, Sep 25, 2014 at 12:59:22PM -0400, Jason Cooper wrote:
On Thu, Sep 25, 2014 at 02:24:14AM +0400, Solar Designer wrote:On Wed, Sep 24, 2014 at 06:08:21PM -0400, Jason Cooper wrote:[jason@localhost] $ ssh -i .ssh/test_key -o 'rsaauthentication yes' 0 '() { ignored; }; /usr/bin/id' uid=1000(jason) gid=1000(jason) groups=1000(jason) [jason@localhost] $ # add 'command=/path/to/secsh -f /path/to/test.rc' in .ssh/authorized_keys on server [jason@localhost] $ ssh -i .ssh/test_key -o 'rsaauthentication yes' 0 '() { ignored; }; /usr/bin/id' secsh v0.8-rc1-2-ga86f09832fa2: access denied.This is puzzling. I tried: command="/bin/env - date" and: command="exec /bin/env - date" and neither prevents exploitation of the issue as above (I get the output of "id", not of "date"), which is not surprising given that the command is run via the shell before it reaches "env". Maybe your target user account's login shell is not bash? That would explain it, but it's also the easier case where the issue had been exposed via a subshell only (does your test.rc explicitly use bash?)Nope, login shell is /bin/bash. Please look at the code in http://git.infradead.org/users/jcooper/secsh.git/blob/HEAD:/match.c
I expected your code to be irrelevant, because the shell gets invoked first (to invoke your code). I tested this with "env -".
There is no shell, bash or otherwise, called ever.
Huh? I thought OpenSSH always invokes the command via the shell.
While tinkering with this, I discovered that if you force ssh to provide a pty (ssh -t ...), even with secsh locked down, the hack works. You *must* set 'no-pty' after 'command=' in your authorized_keys file to prevent ssh from launching a shell. :-/
Oh, so you're saying that your sshd does not use the shell when you specify no-pty? This isn't the case here. What version/package of OpenSSH are you using? I do have a habit to specify no-pty whenever I use "command=", but I also have a habit to start the actual command with "exec ..." specifically because the shell is invoked anyway (the "exec" then saves some memory on not keeping that shell around while the actual program runs). I've tried specifying /full/path/to/program, like you do, but this does not prevent invocation going via the shell here. My OpenSSH is rather old, though (with lots of patches). Alexander
Current thread:
- Re: CVE-2014-6271: remote code execution through bash, (continued)
- Re: CVE-2014-6271: remote code execution through bash Michal Zalewski (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Florian Weimer (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Hanno Böck (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Florian Weimer (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Michal Zalewski (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Pierre Schweitzer (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash gremlin (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Jason Cooper (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Jason Cooper (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Michal Zalewski (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 24)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Huzaifa Sidhpurwala (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 26)