Date: Mon, 29 Sep 2014 12:46:28 -0600 From: "Todd C. Miller" <Todd.Miller@...rtesan.com> To: oss-security@...ts.openwall.com cc: Florian Weimer <fweimer@...hat.com>, Tavis Ormandy <taviso@...xchg8b.com>, chet.ramey@...e.edu, Michal Zalewski <lcamtuf@...edump.cx>, Solar Designer <solar@...nwall.com> Subject: Re: Re: Healing the bash fork On Mon, 29 Sep 2014 09:59:47 -0600, Eric Blake wrote: > 'at' is already broken, independently of bash. For example: > > https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00300.html > > echo pwd | env "/tmp/exploit=me" at tomorrow > > produces a shell script with these lines: > > #!/bin/sh > ... > /tmp/exploit=me; export /tmp/exploit > > So even on Debian, where /bin/sh is dash, this script attempts to > execute the file named /tmp/exploit=me, possibly under the privileges > of 'at' rather than as the user that created the file. No bash needed. At the very least, at should use the "export foo=bar" form which will allow it to fail closed in the presence of environment variables that are not valid shell identifiers. I've just committed such a change to OpenBSD's at(1) which shares a common lineage. However, the atrun file format should really be changed to be more robust and not simply be fed to /bin/sh. - todd
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.