Date: Wed, 24 Sep 2014 18:36:16 +0200 From: Florian Weimer <fweimer@...hat.com> To: oss-security@...ts.openwall.com CC: chet.ramey@...e.edu Subject: Re: CVE-2014-6271: remote code execution through bash On 09/24/2014 04:05 PM, Florian Weimer wrote: > Stephane Chazelas discovered a vulnerability in bash, related to how > environment variables are processed: trailing code in function > definitions was executed, independent of the variable name. It was pointed out to me off-list that a patched bash will still import functions from the environment, including from variable names which override shell commands. This is not an immediate vulnerability because it requires setting environment variables under *specific* names. If you can do that, there are already many variables which can affect the execution of shell scripts, and some of them offer direct code execution because they are subject to command substitution (BASH_ENV, for example). The current vulnerability mainly exists because the name of the environment variable does not matter at all. My main concern with the current patch is that still exposes the bash parser and function definition printer to attacks from the network. Bugs in those fairly large components could cause another critical issue. For hardening against such issues, I proposed a separate environment variable with a well-known name, say BASH_FUNCDEFS, which lists the names of environment variables which are to be imported as functions. This would bring the attack requirements to the level which we have with BASH_ENV now. Removing the functionality completely is difficult because it is actually used (search for “export -f”). (If you find additional bugs, please do not discuss them here, but follow the usual disclosure procedures. Thanks.) -- Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.