Date: Thu, 25 Sep 2014 11:36:24 -0400 From: Chet Ramey <chet.ramey@...e.edu> To: Solar Designer <solar@...nwall.com> CC: chet.ramey@...e.edu, oss-security@...ts.openwall.com Subject: Re: CVE-2014-6271: remote code execution through bash On 9/24/14, 8:14 PM, Solar Designer wrote: > On Wed, Sep 24, 2014 at 03:12:08PM -0400, Chet Ramey wrote: >> There are several options for making shell functions inherited via the >> environment more robust, none of them backwards compatible. I will >> choose one and implement it for a future bash version. >> >> The leading candidates both raise the bar by requiring a potential >> attacker to be able to create arbitrarily-named environment variables as >> well as environment variables with specific values. >> >> I considered (and implemented) a blacklist approach that would have >> protected against a set of commonly-named variables (HTTP_*, CGI_*, >> SSH_*, LC_*, and so on), but the consensus was that that was too easily >> circumvented. I removed it from the distributed patches. > > What about no longer inheriting functions with names that don't contain > any lowercase letters? It's a heuristic like any other, but I think it's even more obscure and mysterious than the other suggestions. Chet -- ``The lyf so short, the craft so long to lerne.'' - Chaucer ``Ars longa, vita brevis'' - Hippocrates Chet Ramey, ITS, CWRU chet@...e.edu http://cnswww.cns.cwru.edu/~chet/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.