[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140925173141.GA2460@openwall.com>
Date: Thu, 25 Sep 2014 21:31:41 +0400
From: Solar Designer <solar@...nwall.com>
To: Jason Cooper <osssecurity@...edaemon.net>
Cc: oss-security@...ts.openwall.com, chet.ramey@...e.edu
Subject: Re: CVE-2014-6271: remote code execution through bash
On Thu, Sep 25, 2014 at 12:59:22PM -0400, Jason Cooper wrote:
> On Thu, Sep 25, 2014 at 02:24:14AM +0400, Solar Designer wrote:
> > On Wed, Sep 24, 2014 at 06:08:21PM -0400, Jason Cooper wrote:
> > > [jason@...alhost] $ ssh -i .ssh/test_key -o 'rsaauthentication yes' 0 '() { ignored; }; /usr/bin/id'
> > > uid=1000(jason) gid=1000(jason) groups=1000(jason)
> > > [jason@...alhost] $ # add 'command=/path/to/secsh -f /path/to/test.rc' in .ssh/authorized_keys on server
> > > [jason@...alhost] $ ssh -i .ssh/test_key -o 'rsaauthentication yes' 0 '() { ignored; }; /usr/bin/id'
> > > secsh v0.8-rc1-2-ga86f09832fa2: access denied.
> >
> > This is puzzling. I tried:
> >
> > command="/bin/env - date"
> >
> > and:
> >
> > command="exec /bin/env - date"
> >
> > and neither prevents exploitation of the issue as above (I get the
> > output of "id", not of "date"), which is not surprising given that the
> > command is run via the shell before it reaches "env".
> >
> > Maybe your target user account's login shell is not bash? That would
> > explain it, but it's also the easier case where the issue had been
> > exposed via a subshell only (does your test.rc explicitly use bash?)
>
> Nope, login shell is /bin/bash. Please look at the code in
>
> http://git.infradead.org/users/jcooper/secsh.git/blob/HEAD:/match.c
I expected your code to be irrelevant, because the shell gets invoked
first (to invoke your code). I tested this with "env -".
> There is no shell, bash or otherwise, called ever.
Huh? I thought OpenSSH always invokes the command via the shell.
> While tinkering with this, I discovered that if you force ssh to provide
> a pty (ssh -t ...), even with secsh locked down, the hack works. You
> *must* set 'no-pty' after 'command=' in your authorized_keys file to
> prevent ssh from launching a shell. :-/
Oh, so you're saying that your sshd does not use the shell when you
specify no-pty? This isn't the case here. What version/package of
OpenSSH are you using?
I do have a habit to specify no-pty whenever I use "command=", but I
also have a habit to start the actual command with "exec ..."
specifically because the shell is invoked anyway (the "exec" then saves
some memory on not keeping that shell around while the actual program
runs). I've tried specifying /full/path/to/program, like you do, but
this does not prevent invocation going via the shell here. My OpenSSH
is rather old, though (with lots of patches).
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
