oss-security - Re: CVE-2014-6271: remote code execution through bash

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat, 27 Sep 2014 21:39:19 -0400
From: Chet Ramey <chet.ramey@...e.edu>
To: Tavis Ormandy <taviso@...xchg8b.com>, Florian Weimer <fw@...eb.enyo.de>
CC: chet.ramey@...e.edu, Michal Zalewski <lcamtuf@...edump.cx>,
        Solar Designer <solar@...nwall.com>, oss-security@...ts.openwall.com,
        Eric Blake <eblake@...hat.com>
Subject: Re: CVE-2014-6271: remote code execution through bash

On 9/27/14, 2:17 PM, Chet Ramey wrote:
> On 9/27/14, 10:28 AM, Tavis Ormandy wrote:
> 
>> It does look bad, but are you sold on the prefix/suffix solution Chet?
>> That will at least mean these are not security issues.
> 
> Yes.  I have no problems worth mentioning with the exported function
> encoding approach.  I have attached patches implementing it that can
> be applied to bash versions from bash-2.05b to bash-4.3.  Please take
> a look, make sure they can be applied cleanly, and so on.
> 
> There is another discussion worth having before officially releasing
> these, which I will do later today.

OK, here are the more-or-less final versions of the patches for bash-2.05b
through bash-4.3.  I made two changes from earlier today: the function
export suffix is now `%%', which is not part of a the set of valid variable
name characters but avoids any potential problems with including
shell metacharacters in the name; and this version refuses to import shell
functions whose name contains a slash, for reasons I discussed earlier.

Please let me know if you have any issues with these.

Chet
-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
		 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet@...e.edu    http://cnswww.cns.cwru.edu/~chet/

View attachment "funcexport-encode-2.05b.patch" of type "text/x-patch" (5818 bytes)

View attachment "funcexport-encode-3.0.patch" of type "text/x-patch" (5822 bytes)

View attachment "funcexport-encode-3.1.patch" of type "text/x-patch" (5764 bytes)

View attachment "funcexport-encode-3.2.patch" of type "text/x-patch" (5764 bytes)

View attachment "funcexport-encode-4.0.patch" of type "text/x-patch" (5764 bytes)

View attachment "funcexport-encode-4.1.patch" of type "text/x-patch" (5764 bytes)

View attachment "funcexport-encode-4.2.patch" of type "text/x-patch" (5764 bytes)

View attachment "funcexport-encode-4.3.patch" of type "text/x-patch" (5990 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.