Re: CVE-2014-6271: remote code execution through bash

[Chet Ramey <chet.ramey () case edu>]

On 9/25/14, 3:39 PM, Tavis Ormandy wrote:
> On Thu, Sep 25, 2014 at 12:18 PM, Chet Ramey <chet.ramey () case edu> wrote:
> > On 9/25/14, 12:15 PM, Solar Designer wrote:
> >
> > > What do you think of distros' going with Florian's prefix-suffix patch
> > > right now?  I think it breaks function imports/exports between
> > > pre-patch and post-patch bash versions, but keeps them intact for
> > > patched versions.  Right?  If so, this sounds acceptable for immediate
> > > use by distros.  Do you agree?
> >
> > I haven't looked at that particular patch in detail yet, but I am wondering
> > why adding both a prefix and a suffix is better than just adding a prefix.
>
> I think it's just paranoia, it demonstrates significant enough control
> over the environment that it's unlikely someone could construct it via
> a naive cgi environment or similar. If someone can create variables
> with an arbitrary suffix and prefix, then there are likely bigger
> problems to worry about than what bash is doing. FWIW, I like
> Florian's approach.

Yeah, that general approach is probably the best.  I was just wondering.
I don't really see the need to use a prefix and a suffix, though.

-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet () case edu    http://cnswww.cns.cwru.edu/~chet/