Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 24 Sep 2014 18:36:16 +0200
From: Florian Weimer <>
Subject: Re: CVE-2014-6271: remote code execution through bash

On 09/24/2014 04:05 PM, Florian Weimer wrote:
> Stephane Chazelas discovered a vulnerability in bash, related to how
> environment variables are processed: trailing code in function
> definitions was executed, independent of the variable name.

It was pointed out to me off-list that a patched bash will still import 
functions from the environment, including from variable names which 
override shell commands.  This is not an immediate vulnerability because 
it requires setting environment variables under *specific* names.  If 
you can do that, there are already many variables which can affect the 
execution of shell scripts, and some of them offer direct code execution 
because they are subject to command substitution (BASH_ENV, for 
example).  The current vulnerability mainly exists because the name of 
the environment variable does not matter at all.

My main concern with the current patch is that still exposes the bash 
parser and function definition printer to attacks from the network. Bugs 
in those fairly large components could cause another critical issue.

For hardening against such issues, I proposed a separate environment 
variable with a well-known name, say BASH_FUNCDEFS, which lists the 
names of environment variables which are to be imported as functions. 
This would bring the attack requirements to the level which we have with 

Removing the functionality completely is difficult because it is 
actually used (search for “export -f”).

(If you find additional bugs, please do not discuss them here, but 
follow the usual disclosure procedures.  Thanks.)

Florian Weimer / Red Hat Product Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.