[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1dab9d0b-cd90-406a-81a5-5b20fffe81a5@gmail.com>
Date: Tue, 30 Sep 2025 01:02:01 -0500
From: Jacob Bachmeyer <jcb62281@...il.com>
To: oss-security@...ts.openwall.com, Solar Designer <solar@...nwall.com>
Subject: Re: How to do secure coding and create secure software
On 9/30/25 00:23, Solar Designer wrote:
> [...]
> So is the vulnerability in the shell, like Shellshock was determined to
> be? [...] the shell maintainers may well dispute this CVE on
> such grounds as well as because the shell worked exactly as documented. [...]
Small nit here: Shellshock was clearly a vulnerability in Bash and I am
unsure if the way Bash exports shell functions was documented at all.
If presented with an environment variable value having the correct form
for a shell function, but containing more text than the body of the
function, Bash would immediately execute the trailing text as commands
while importing the shell function from the environment. That was
Shellshock.
This went unnoticed for years because Bash, of course, would never
include trailing text when *exporting* a shell function, so the
vulnerable code path went unexercised. I have used Shellshock as a
counterexample to claims that input validation is unneeded because the
data will always be written correctly in the proper format by the same
program.
-- Jacob
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
