Re: Healing the bash fork

[Michal Zalewski <lcamtuf () coredump cx>]

> Florian's prefix/suffix patch is not going to protect against the setuid/setgid exploit that I reported to this list 
> last week.
>
> I discuss the setuid/setgid vulnerability at the following site, including demonstrating how Florian's prefix/suffix 
> patch provides no protection:
>
> http://technicalprose.blogspot.co.uk/2014/09/shellshock-bug-third-vulnerability.html

You do realize that your setuid program is patently unsafe, right? Say:

$ echo -e '#!/bin/sh\necho pwn3d' >date;chmod 755 date;PATH=.:$PWD
./setuid_program
pwn3d

/mz