Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 29 Sep 2014 12:46:28 -0600
From: "Todd C. Miller" <Todd.Miller@...rtesan.com>
To: oss-security@...ts.openwall.com
cc: Florian Weimer <fweimer@...hat.com>, Tavis Ormandy <taviso@...xchg8b.com>,
        chet.ramey@...e.edu, Michal Zalewski <lcamtuf@...edump.cx>,
        Solar Designer <solar@...nwall.com>
Subject: Re: Re: Healing the bash fork

On Mon, 29 Sep 2014 09:59:47 -0600, Eric Blake wrote:

> 'at' is already broken, independently of bash.  For example:
> 
> https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00300.html
> 
> echo pwd | env "/tmp/exploit=me" at tomorrow
> 
> produces a shell script with these lines:
> 
> #!/bin/sh
> ...
> /tmp/exploit=me; export /tmp/exploit
> 
> So even on Debian, where /bin/sh is dash, this script attempts to
> execute the file named /tmp/exploit=me, possibly under the privileges
> of 'at' rather than as the user that created the file.  No bash needed.

At the very least, at should use the "export foo=bar" form which
will allow it to fail closed in the presence of environment variables
that are not valid shell identifiers.  I've just committed such a
change to OpenBSD's at(1) which shares a common lineage.  However,
the atrun file format should really be changed to be more robust
and not simply be fed to /bin/sh.

 - todd

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.