Re: more bash parser bugs (CVE-2014-6277, CVE-2014-6278)

[Chet Ramey <chet.ramey () case edu>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/1/14, 2:20 PM, Hanno Böck wrote:
> Haven't seen it here yet. lcamtuf now disclosed details of the two
> further parser bugs he found:
> http://lcamtuf.blogspot.de/2014/10/bash-bug-how-we-finally-cracked.html
>
> Basically if anyone hasn't applied one of the prefix patches yet now's
> the time to do so.
>
> While prefixing should shield against them they should still be fixed
> for good.
>
> CVE-2014-6277 can still be triggered to segfault a fully patched bash:
> bash -c "f(){ x(){ _;}; x(){ _;}<<a;}"
>
> Second issue PoC on fully patched system:
> env BASH_FUNC_x%%='() { _;}>_[$($())] { echo vuln;}' bash -c :
>
> (both likely not exploitable due to prefix shielding, but should be
> fixed anyway)

I have patches for these, and they are in the pipeline.

Chet

- -- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet () case edu    http://cnswww.cns.cwru.edu/~chet/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (Darwin)

iEYEARECAAYFAlQsR6oACgkQu1hp8GTqdKtxOQCdGtpKc/kiYnypk44IlIp3y1C2
3MAAnRiNiAdo8SAHubCwKlrHGU4hnHXa
=wGXW
-----END PGP SIGNATURE-----