CVE-2014-7169: Bash Fix Incomplete, Still Exploitable

Post by justincormack » Thu, Sep 25, 2014, 12:00 PM UTC

ordinary wrote: post #94

owenfi wrote: post #88

The exploit worked against my cgi perl scripts as well! I had cgi-bin/update.pl running on OS X and I exploited it as mentioned here: https://twitter.com/hernano/status/514866681530023936 My perl scripts call $out = `git pull`, log to a file, and print a response; I was quite surprised the exploit worked against them. Promptly disabled, upgraded bash, and re-enabled, now disabling all cgi for a bit longer. What are t…

Perl backticks and system() delegate commands to the system shell, normally sh. On many systems, sh is simply bash in compatibility mode. That's how the attacker gets at the vulnerability.

Post by Pyppe » Thu, Sep 25, 2014, 12:03 PM UTC

Post by jgeralnik » Thu, Sep 25, 2014, 12:08 PM UTC

daveloyall wrote: post #4

WestCoastJustin wrote: post #3

Appears to work, even with latest patches, by using sh (from the link): $ env X='() { (a)=>\' sh -c "echo date"; cat echo date Wed Sep 24 15:00:34 PDT 2014 -- previous bug fix for bash (before/after patch) -- $ x='() { :;}; echo vulnerable' bash -c 'echo test' vulnerable test $ x='() { :;}; echo vulnerable' bash -c 'echo test' bash: warning: x: ignoring function definition attempt bash: error importing function defin…

I don't think either you or the author are correct. hobbes@media:~$ env X='() { (a)=>\' sh -c "echo date"; cat echo date cat: echo: No such file or directory hobbes@media:~$ uname -a Linux media 3.13-1-686-pae #1 SMP Debian 3.13.5-1 hobbes@media:~$ echo $BASH_VERSION 4.3.25(1)-release It looks to me like we're setting X in the environment, calling `sh -c "echo date"`, passing that X in to it, nothing happens, then we…

Post by andruby » Thu, Sep 25, 2014, 12:13 PM UTC

limsdims wrote: post #162

My Zsh seems vulnerable. Anyone else care to replicate this? -- ➜ ~ zsh --version zsh 5.0.2 (x86_64-apple-darwin13.0) ➜ ~ echo $SHELL /bin/zsh ➜ ~ env x='() { do_something;}; echo vulnerable' bash -c "echo this is a test" vulnerable this is a test ---

  env x='() { do_something;}; echo vulnerable' zsh -c "echo this is a test"
  this is a test

Post by userbinator » Thu, Sep 25, 2014, 12:16 PM UTC

ygra wrote: post #119

userbinator wrote: post #62

It looks like the important part of the patch (bash43-025) is here: In builtins/evalstring.c: if ((flags & SEVAL_FUNCDEF) && command->type != cm_function_def) In variables.c: parse_and_execute (temp_string, name, SEVAL_NONINT|SEVAL_NOHIST|SEVAL_FUNCDEF|SEVAL_ONECMD); So what the patch does is create a special mode of parse_and_execute() where it's supposed to only evaluate function definitions. A better option would…

Wouldn't that break the feature? Function definitions need to be executed so that they are available, right?