Re: Healing the bash fork

[Tavis Ormandy <taviso () cmpxchg8b com>]

On 29 September 2014 10:39, Kobrin, Eric <ekobrin () akamai com> wrote:
> On Sep 29, 2014, at 11:59 AM, Eric Blake <eblake () redhat com> wrote:
>
> > But I see no reason to move away from %% suffixing.
>
> The suffix fixes the obvious CGI hole, but it leaves exposed programs in which the adversary gets to choose the 
> variable name as well.
>
> env $'BASH_FUNC_foo%%=() { echo 123\n }' bash -c "foo"
>
> I think that a more robust solution, such using a separate store for functions, is needed if function import is to 
> survive as a feature.
>
> -- Eric Kobrin

If an adversary can choose the variable name, it's game over by
definition. He can choose LD_PRELOAD, SHELLOPTS='xtrace' PS4='$(foo)',
LD_DEBUG_OUTPUT, PYTHONINSPECT, etc, etc.

This general solution is robust, now we're just hammering out the details.

-- 
-------------------------------------
taviso () cmpxchg8b com | pgp encrypted mail preferred
-------------------------------------------------------