Date: Fri, 26 Sep 2014 12:41:51 +0200 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: Re: Re: CVE-2014-6271: remote code execution through bash (3rd vulnerability) On Fri, 26 Sep 2014 09:54:40 +0100 "Mark R Bannister" <mark@...seconsulting.co.uk> wrote: > I can't see this being a problem for Apache custom headers (the > variable name is turned to uppercase and prefixed by HTTP_), nor sudo > commands if env_reset is on (the default), but this continues to be a > major vulnerability for setuid/setgid scripts (S_ISUID or S_ISGID) > where the environment is preserved. scripts don't allow setuid. for a reason. It'd open a whole bunch of security issues. This could be an issue if you have a suid binary calling a script. There are even people writing howtos to do that to circumvent unix security measures.  I don't know (and haven't tested) if this preserves env, but the point is: suid binaries shouldn't do stupid things. If they do that's their fault. There should be extra many security conscious eyes on setuid bins (we recently saw a memleak in a setuid bin causing trouble elsewhere ). If you can pass any env var to a suid script and it executes something else you have a problem no matter what. LD_PRELOAD etc.  http://www.tuxation.com/setuid-on-shell-scripts.html  http://googleprojectzero.blogspot.de/2014/08/the-poisoned-nul-byte-2014-edition.html cu, -- Hanno Böck http://hboeck.de/ mail/jabber: hanno@...eck.de GPG: BBB51E42 Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.