[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201409291846.s8TIkSMv019314@core.courtesan.com>
Date: Mon, 29 Sep 2014 12:46:28 -0600
From: "Todd C. Miller" <Todd.Miller@...rtesan.com>
To: oss-security@...ts.openwall.com
cc: Florian Weimer <fweimer@...hat.com>, Tavis Ormandy <taviso@...xchg8b.com>,
chet.ramey@...e.edu, Michal Zalewski <lcamtuf@...edump.cx>,
Solar Designer <solar@...nwall.com>
Subject: Re: Re: Healing the bash fork
On Mon, 29 Sep 2014 09:59:47 -0600, Eric Blake wrote:
> 'at' is already broken, independently of bash. For example:
>
> https://lists.gnu.org/archive/html/bug-bash/2014-09/msg00300.html
>
> echo pwd | env "/tmp/exploit=me" at tomorrow
>
> produces a shell script with these lines:
>
> #!/bin/sh
> ...
> /tmp/exploit=me; export /tmp/exploit
>
> So even on Debian, where /bin/sh is dash, this script attempts to
> execute the file named /tmp/exploit=me, possibly under the privileges
> of 'at' rather than as the user that created the file. No bash needed.
At the very least, at should use the "export foo=bar" form which
will allow it to fail closed in the presence of environment variables
that are not valid shell identifiers. I've just committed such a
change to OpenBSD's at(1) which shares a common lineage. However,
the atrun file format should really be changed to be more robust
and not simply be fed to /bin/sh.
- todd
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
