Date: Wed, 8 Oct 2014 16:11:22 +0100 From: "stephane.chazelas" <stephane.chazelas@...il.com> To: "David A. Wheeler" <dwheeler@...eeler.com> Cc: oss-security <oss-security@...ts.openwall.com> Subject: Re: Stéphane Chazelas: How *DID* you find Shellshock? 2014-10-08 10:26:21 -0400, David A. Wheeler: > This is a question for Stéphane Chazelas, but I'm "cc"ing > oss-security because I think many of us want to know the > answer. > > Stéphane: How *DID* you find Shellshock, in as much detail as you can recall? > > I'm told you found the bug after "reflecting on an earlier > bug" you found in bash "a few months earlier." > (http://www.smh.com.au/it-pro/security-it/stephane-chazelas-the-man-who-found-the-webs-most-dangerous-internet-security-bug-20140927-10mixr.html) > > What I'm hoping is that we can learn some lessons and re-apply > them elsewhere. [...] That's something I've been asked often and all the journalists have transformed what I said. In any case, I didn't find the bug by observing exploits, I have no reason to beleive it's been exploited before being disclosed (though of course I can't rule it out). I did not find it by looking at bash's code either. some copy-pasting of what I've said to others: In July, I had found a vulnerability in the GNU libc (not bash) related to environment variables (CVE-2014-0475). It could be network exploitable with one particular vector: the bypass of OpenSSH's ForceCommand (used for instance in git servers or poor-man's VPNs). And it was agravated by a poor design choice of bash [(actually two: the parsing of .bashrc over ssh and the locale dependant parsing (that latter one not specific to bash))] which again could cause arbitrary command execution if enough conditions were met (a very narrow attack surface compared to shellshock). Again, that was not following any observation of an exploit attempt, just a reflection on a mechanism I knew about. I put that attack vector in context with that little known feature of bash, the exporting/importing of functions for which I already knew part of the mechanism. Started to think of the possible way it was implemented, thought that it could very well be the very simplest way, in which case that was a big security hole. More details at http://thread.gmane.org/gmane.comp.shells.bash.bugs/22367 Which I've just posted. and: http://thread.gmane.org/gmane.comp.shells.bash.bugs/22096 -- Stephane
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.