Date: Thu, 25 Sep 2014 08:52:43 -0700 From: Michal Zalewski <lcamtuf@...edump.cx> To: oss-security@...ts.openwall.com Subject: Re: CVE-2014-6271 first patch and remote exploit via CGI > In the press, there are contrary statements about the initial patches > posted by Florian Weimer. A user on Twitter posted that the patch was > incomplete. There is agreement on that much. Where I see different > responses is on whether the first patch can still be exploited remotely via > the CGI vector outlined in Florian's initial post, and what damage can > still be done. I haven't seen a proof of concept yet, but I also haven't > seen a trusted voice give a definitive statement that it can't be abused. > > Could anyone lay out what's still possible for a remote attacker via CGI > with only the first patch applied? The first patch closes the immediate RCE loophole. Many people have expressed concerns that the patch is dangerous because in many real-world situations, it still permits bash to parse function definitions originating from attackers, and the security of the scheme hinges on the parser not having the usual range of low-level C language bugs that normally plague such code; and, on top of that, the parsing process having absolutely no side effects on the subsequently executed scripts. Both of these assumptions have been shown to be incorrect, although not to directly execute code in the most likely scenarios that would be vulnerable without the original patch; so, you're probably OK, but relying on thing staying this way is fragile. There's an unofficial patch from Florian that limits the exposure: http://www.openwall.com/lists/oss-security/2014/09/25/13 You have to use your own judgment to decide whether to stick to the original patch, also use Florian's one in the interim, or do something else. /mz
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.