Re: Re: Re: CVE-2014-6271: remote code execution through bash (3rd vulnerability)

[Bryan Drewery <bdrewery () FreeBSD org>]

On 2014-09-26 15:52, Bryan Drewery wrote:
> On 9/26/2014 9:13 AM, Christos Zoulas wrote:
> > On Sep 26,  1:47pm, john.haxby () oracle com (John Haxby) wrote:
> > -- Subject: Re: [oss-security] Re: CVE-2014-6271: remote code 
> > execution throu
> >
> > | It's not so much the known attacks -- redefining ls, unset, command,
> > | typeset, declare, etc -- it's the future parser bugs that we don't 
> > yet
> > | know about.
> > |
> > | A friend of mine said this could be a vulnerability gift that keeps 
> > on
> > | giving.
> >
> > I think that at this point the conservative approach is best, so
> > until the bash author figures what the best solution is, the feature
> > is disabled by default for NetBSD. It is not wise to expose bash's
> > parser to the internet and then debug it live while being attacked.
> >
> > christos
>
> FreeBSD has taken a similar approach. We have used Christos' patch and
> disabled the feature by default.
>
> https://svnweb.freebsd.org/changeset/ports/369341

FYI I have updated the FreeBSD bash to 27 and modified the 
--import-functions script to be implicit for interactive shells and to 
also give a warning when functions are ignored.

https://svnweb.freebsd.org/ports/head/shells/bash/files/extrapatch-import-functions?revision=369467&view=co&pathrev=369467

--
Regards,
Bryan Drewery