oss-sec mailing list archives

Re: CVE-2014-6271: remote code execution through bash

From: Michal Zalewski <lcamtuf () coredump cx>
Date: Thu, 25 Sep 2014 12:53:35 -0700

Yeah, that general approach is probably the best.  I was just wondering.
I don't really see the need to use a prefix and a suffix, though.


Prefix is definitely more valuable, because specific prefixes are
enforced by Apache and its ilk, but the suffix for the HTTP header ->
shell variable propagation is within attacker's control.

/mz

Current thread:

Re: Re: Healing the bash fork, (continued)
- - - Re: Re: Healing the bash fork Todd C. Miller (Sep 29)
    - atd (was: Re: [oss-security] Re: Healing the bash fork) Seth Arnold (Sep 29)
    - Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 24)
    - Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 25)
    - Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 25)
    - Re: CVE-2014-6271: remote code execution through bash Christos Zoulas (Sep 25)
    - Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 25)
    - Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 25)
    - Re: CVE-2014-6271: remote code execution through bash Tavis Ormandy (Sep 25)
    - Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 25)
    - Re: CVE-2014-6271: remote code execution through bash Michal Zalewski (Sep 25)
    - Re: CVE-2014-6271: remote code execution through bash Florian Weimer (Sep 25)
- Re: CVE-2014-6271: remote code execution through bash Hanno Böck (Sep 24)
  - Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 24)
    - Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 24)
    - Re: CVE-2014-6271: remote code execution through bash Anthony Liguori (Sep 24)
    - Re: CVE-2014-6271: remote code execution through bash Solar Designer (Sep 24)
    - Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 24)
    - Re: CVE-2014-6271: remote code execution through bash Huzaifa Sidhpurwala (Sep 24)
    - Re: CVE-2014-6271: remote code execution through bash Huzaifa Sidhpurwala (Sep 24)
    - Re: CVE-2014-6271: remote code execution through bash Chet Ramey (Sep 24)

(Thread continues...)