221–226 of 226 posts
OK two questions: 1. Does zsh (or other shells) also have these kind of string processings where bugs are likely? 2. Is there a way to completely remove bash from the system and use zsh (or other shells) instead?
Proposed patch for CVE-2014-7169 here: http://www.openwall.com/lists/oss-security/2014/09/25/10 I am building bash updates for Ubuntu containing the proposed fix here and will publish them once the fix has been made official: https://launchpad.net/~ubuntu-security-proposed/+archive/ubu...
Proposed patch for CVE-2014-7169 here: http://www.openwall.com/lists/oss-security/2014/09/25/10 I am building bash updates for Ubuntu containing the proposed fix here and will publish them once the fix has been made official: https://launchpad.net/~ubuntu-security-proposed/+archive/ubu...
For anyone landing here, mdeslaur and the Ubuntu team has now released a patch for CVE-2014-7169. http://www.ubuntu.com/usn/usn-2363-1/
A little off topic, but am I still vulnerable? I'm running OSX mavericks 10.9.5, use zsh as my default shell, and have a patched version of bash build from homebrew repo set as secondary in /etc/shells (on the occasion I need bash, I like to have completions). System bash is still vulnerable. With my current configuration, how worried should I be? Any insight is appreciated!
Yes, you are still vulnerable. I happen to be on Mountain Lion instead of Mavericks, but you can easily check yourself. $ /bin/sh --version GNU bash, version 3.2.48(1)-release (x86_64-apple-darwin12) Copyright (C) 2007 Free Software Foundation, Inc. As long as you have a /bin/sh or /bin/bash that is of a vulnerable version, then any shell script which begins with #!/bin/sh or #!/bin/bash, and is executed in an enviro…
Earlier quoted context omitted.
Don't think "how can an attacker get me by prepending '>' or ' Think "the buggy bash parser is still exposed to an attacker, and nobody really knows what it can be made to do."
Yeah, I hear you. Well let's see... All of these work for me (bash 4.3 including yesterday's patches on Debian sid amd64): hobbes@metalbaby:~$ unset badvar; rm somefile; export badvar='() { (a)=>\'; bash -c "somefile echo tricksie"; cat somefile hobbes@metalbaby:~$ unset badvar; rm somefile; export badvar='() { (b)=>\'; bash -c "somefile echo tricksie"; cat somefile hobbes@metalbaby:~$ unset badvar; rm somefile; expo…
http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-...