Re: CVE-2014-6271: remote code execution through bash

[Chet Ramey <chet.ramey () case edu>]

On 9/25/14, 12:20 PM, Simon McVittie wrote:
> On 25/09/14 16:59, John Haxby wrote:

> > There are lots of things one could do to eliminate that risk, of course,
> > but step back and what are we arguing for?
>
> I'm arguing that privilege boundaries should take responsibility for
> their nature as a privilege boundary, and not pass the buck to the code
> that they call into.

It doesn't help if some process sets ruid = euid and execs bash, but bash
doesn't import functions from the environment if ruid != euid.

Chet
-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet () case edu    http://cnswww.cns.cwru.edu/~chet/