Re: Re: CVE-2014-6271: remote code execution through bash (3rd vulnerability)

["Kobrin, Eric" <ekobrin () akamai com>]

On Sep 29, 2014, at 10:33 AM, Chet Ramey <chet.ramey () case edu> wrote:
> If that is the command you ran, this doesn't show any vulnerability. 

I've seen quite a few examples like this which don't do precisely what the submitter thought.

I hope this isn't another such example:

$ env $'BASH_FUNC_\nfoo%%=() { echo 123\n }' ./bash -c 'foo'
./bash: error importing function definition for `
foo'
123

This doesn't seem like desired behavior.

In the version before the recent patches, adding unexpected characters could cause segfaults.

-- Eric