oss-security - Re: CVE-2014-6271: remote code execution through bash

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <542322F1.2080707@case.edu>
Date: Wed, 24 Sep 2014 16:00:49 -0400
From: Chet Ramey <chet.ramey@...e.edu>
To: mancha <mancha1@...o.com>, oss-security@...ts.openwall.com
CC: chet.ramey@...e.edu
Subject: Re: CVE-2014-6271: remote code execution through bash

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 9/24/14, 3:12 PM, mancha wrote:

> Hello Chet et al.
> 
> While taking a closer look at this issue on Bash 4.2, I noticed a
> potential NULL deref. i.e.
> 
>   $ FOO='() { :;}; blah4242' bash -c "echo bleh"
> 
> This occurs in bgp_prune() where, because bgpids.npid=0 and
> js_c_childmax=-1, the code in the loop executes but bgpids.list=NULL.

Thanks for the report.  This is a problem, but the patch closes off
that code path.

Chet

- -- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
		 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet@...e.edu    http://cnswww.cns.cwru.edu/~chet/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (Darwin)

iEYEARECAAYFAlQjIvAACgkQu1hp8GTqdKulqgCeKgb8enVUZMM9qQgmCAEgjpg0
C2QAnRGtrZb9Uh9kMTAiDvtI9E6U5BSp
=Fxrx
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.