Re: Stéphane Chazelas: How *DID* you find Shellshock?

["stephane.chazelas" <stephane.chazelas () gmail com>]

2014-10-08 10:26:21 -0400, David A. Wheeler:
> This is a question for Stéphane Chazelas, but I'm "cc"ing
> oss-security because I think many of us want to know the
> answer.
>
> Stéphane: How *DID* you find Shellshock, in as much detail as you can recall?
>
> I'm told you found the bug after "reflecting on an earlier
> bug" you found in bash "a few months earlier."
> (http://www.smh.com.au/it-pro/security-it/stephane-chazelas-the-man-who-found-the-webs-most-dangerous-internet-security-bug-20140927-10mixr.html)
>
> What I'm hoping is that we can learn some lessons and re-apply
> them elsewhere.
[...]

That's something I've been asked often and all the journalists
have transformed what I said.

In any case, I didn't find the bug by observing exploits, I have
no reason to beleive it's been exploited before being disclosed
(though of course I can't rule it out). I did not find it by
looking at bash's code either.

some copy-pasting of what I've said to others:

In July, I had found a vulnerability in the GNU libc (not bash)
related to environment variables (CVE-2014-0475). It could be
network exploitable with one particular vector: the bypass of
OpenSSH's ForceCommand (used for instance in git servers or
poor-man's VPNs). And it was agravated by a poor design choice
of bash [(actually two: the parsing of .bashrc over ssh and the
locale dependant parsing (that latter one not specific to
bash))] which again could cause arbitrary command execution if
enough conditions were met (a very narrow attack surface
compared to shellshock).

Again, that was not following any observation of an exploit
attempt, just a reflection on a mechanism I knew about.

I put that attack vector in context with that little known
feature of bash, the exporting/importing of functions for which
I already knew part of the mechanism. Started to think of the
possible way it was implemented, thought that it could very well
be the very simplest way, in which case that was a big security
hole.

More details at

http://thread.gmane.org/gmane.comp.shells.bash.bugs/22367
Which I've just posted.

and:

http://thread.gmane.org/gmane.comp.shells.bash.bugs/22096

-- 
Stephane