Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 26 Sep 2014 02:35:20 -0700
From: Dwayne Litzenberger <>
Subject: Re: CVE-2014-6271: remote code execution through bash

For folks like me who are running production systems that don't need 
exported functions at all, I've hacked together a little wrapper that 
just refuses to run bash if any environment variable's value starts with 
a left-paren:


    $ ls -l /bin/bash*
    lrwxrwxrwx 1 root root      20 Sep 26 01:12 /bin/bash -> /bin/bash-shellshock
    -rwxr-xr-x 1 root root 1029624 Sep 24 11:51 /bin/bash.real
    -rwxr-xr-x 1 root root   10368 Sep 26 00:32 /bin/bash-shellshock

    $ XX=1 XXX='(hello' /bin/bash -c env
    bash-shellshock: Refusing to start due to possibly unsafe environment variable (see syslog)

It also supports log-only and variable-stripping modes, configurable 

I've made binary .deb packages for Debian and Ubuntu, for anyone foolish 
enough to trust me.  (If you've ever run "sudo pip install pycrypto", 
then you're already that foolish. ;)

Tags and SHA256SUMS.asc files are signed using my OpenPGP key.

Dwayne C. Litzenberger <>
 OpenPGP: 19E1 1FE8 B3CF F273 ED17  4A24 928C EC13 39C2 5CF7

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.