Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 24 Sep 2014 19:12:21 +0000
From: mancha <>
Subject: Re: CVE-2014-6271: remote code execution through bash

On Wed, Sep 24, 2014 at 12:08:46PM -0400, Chet Ramey wrote:
> On 9/24/14, 11:16 AM, Solar Designer wrote:
> > I see no good workaround. 
> You're correct; there is not a good workaround.  Since there are
> publicly available patches for all bash versions back 15 years or so,
> though, the best path forward is to apply those as quickly as
> possible.
> Chet

Hello Chet et al.

While taking a closer look at this issue on Bash 4.2, I noticed a
potential NULL deref. i.e.

  $ FOO='() { :;}; blah4242' bash -c "echo bleh"

This occurs in bgp_prune() where, because bgpids.npid=0 and
js_c_childmax=-1, the code in the loop executes but bgpids.list=NULL.

I didn't look closely enough to know if this situation is only reachable
via the recently-fixed vulnerable code-path or not.


Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.