[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5422F300.7010207@redhat.com>
Date: Wed, 24 Sep 2014 18:36:16 +0200
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
CC: chet.ramey@...e.edu
Subject: Re: CVE-2014-6271: remote code execution through bash
On 09/24/2014 04:05 PM, Florian Weimer wrote:
> Stephane Chazelas discovered a vulnerability in bash, related to how
> environment variables are processed: trailing code in function
> definitions was executed, independent of the variable name.
It was pointed out to me off-list that a patched bash will still import
functions from the environment, including from variable names which
override shell commands. This is not an immediate vulnerability because
it requires setting environment variables under *specific* names. If
you can do that, there are already many variables which can affect the
execution of shell scripts, and some of them offer direct code execution
because they are subject to command substitution (BASH_ENV, for
example). The current vulnerability mainly exists because the name of
the environment variable does not matter at all.
My main concern with the current patch is that still exposes the bash
parser and function definition printer to attacks from the network. Bugs
in those fairly large components could cause another critical issue.
For hardening against such issues, I proposed a separate environment
variable with a well-known name, say BASH_FUNCDEFS, which lists the
names of environment variables which are to be imported as functions.
This would bring the attack requirements to the level which we have with
BASH_ENV now.
Removing the functionality completely is difficult because it is
actually used (search for “export -f”).
(If you find additional bugs, please do not discuss them here, but
follow the usual disclosure procedures. Thanks.)
--
Florian Weimer / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
