Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALx_OUBmeDQS7i8BZYQoRO+TyhTWZhYDa0EXtrNbPoUQvNHQSg@mail.gmail.com>
Date: Thu, 2 Oct 2014 08:04:24 -0700
From: Michal Zalewski <lcamtuf@...edump.cx>
To: oss-security <oss-security@...ts.openwall.com>
Cc: Shawn <citypw@...il.com>
Subject: Re: more bash parser bugs (CVE-2014-6277, CVE-2014-6278)

> According to shellshock  test (https://shellshocker.net/shellshock_test.sh)

That script is a weird mixture of tests that implicitly pay no
attention to Florian's patch, and therefore do not really demonstrate
any security risk:

CVE20147186=$((bash -c 'true <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF
<<EOF <<EOF <<EOF <<EOF <<EOF <<EOF <<EOF' 2>/dev/null || echo
"vulnerable") | grep 'vulnerable' | wc -l)

...ones that explicitly try to circumvent it in a way that makes them
uninteresting from the security perspective:

CVE20146271=$(env 'x=() { :;}; echo vulnerable' 'BASH_FUNC_x()=() {
:;}; echo vulnerable' bash -c "echo test" 2>&1 | grep 'vulnerable' |
wc -l)

...and ones that will fail with Florian's patch:

CVE20147169=$((cd /tmp; rm -f /tmp/echo; env X='() { (a)=>\' bash -c
"echo echo nonvuln" 2>/dev/null; [[ "$(cat echo 2> /dev/null)" ==
"nonvuln" ]] && echo "vulnerable" 2> /dev/null) | grep 'vulnerable' |
wc -l)

There are also some weird / duplicat entries and general confusion
about which CVE stands for what, e.g.:

CVE2014=$(env X=' () { }; echo hello' bash -c 'date' | grep 'hello' | wc -l)
echo -n "CVE-2014-//// (exploit 3 on http://shellshocker.net/): "

Really, just install the patch. The reasons for this, and a good test
case to check if you're covered, are discussed here:

http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.html

If you want to learn a bit more about what these test cases are doing
and why it matters, I have an earlier post here:

http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html

...and last but not least, the details for the last two bugs are here:

http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html

/mz

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.