Re: CVE-2014-6271: remote code execution through bash

[Dwayne Litzenberger <dlitz () dlitz net>]

For folks like me who are running production systems that don't need 
exported functions at all, I've hacked together a little wrapper that 
just refuses to run bash if any environment variable's value starts with 
a left-paren:

   https://github.com/dlitz/bash-shellshock

TL;DR:

   $ ls -l /bin/bash*
   lrwxrwxrwx 1 root root      20 Sep 26 01:12 /bin/bash -> /bin/bash-shellshock
   -rwxr-xr-x 1 root root 1029624 Sep 24 11:51 /bin/bash.real
   -rwxr-xr-x 1 root root   10368 Sep 26 00:32 /bin/bash-shellshock

   $ XX=1 XXX='(hello' /bin/bash -c env
   bash-shellshock: Refusing to start due to possibly unsafe environment variable (see syslog)

It also supports log-only and variable-stripping modes, configurable 
system-wide.

I've made binary .deb packages for Debian and Ubuntu, for anyone foolish 
enough to trust me.  (If you've ever run "sudo pip install pycrypto", 
then you're already that foolish. ;)

Tags and SHA256SUMS.asc files are signed using my OpenPGP key.

--
Dwayne C. Litzenberger <dlitz () dlitz net>
OpenPGP: 19E1 1FE8 B3CF F273 ED17  4A24 928C EC13 39C2 5CF7

Attachment: _bin
Description: