[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 30 Sep 2014 16:07:31 +0200
From: Sebastian Krahmer <krahmer@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: Healing the bash fork
Hi
On Tue, Sep 30, 2014 at 08:41:24AM -0500, Kobrin, Eric wrote:
> > "innocuous looking setuid program" made my day ;)
>
> > We should take care not to blame all and everything to bash.
>
> I don't find that blame is a useful tool for fixing security problems. What's more interesting to me is: what system components are in a position to help. If a change in bash can make a bunch of "innocuous looking setuid programs" not be vectors for the import of malicious functions, let's do it.
In no shell-universe
setreuid(0, 0); system("date");
is an "innocuous looking setuid program". It fails in so many ways
that I cant enumerate it here, despite missing sanity checks for readability
and in that suids must not use system() or popen() in the first place.
If one finds a construct in code that looks similar to this, fix it. Really.
No bash update (and no other shell) will ever make this secure. If we start
fixing the underlying system so that above code is innocuous indeed, rather
than fixing the programmers producing such code, our road ends at php.
Sebastian
--
~ perl self.pl
~ $_='print"\$_=\47$_\47;eval"';eval
~ krahmer@...e.de - SuSE Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
