361–370 of 432 posts
$ env X='() { (a)=>\' sh -c "echo date"; cat echo
https://twitter.com/taviso/status/514887394294652929#
env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "still vulnerable :("
Earlier quoted context omitted.
I'm sorry; perhaps I'm slow. I see the problem, but how can a stranger set an environment variable?
There are a lot of scripts the do something like: curl ' http://myradframework.com/script.sh' | bash That'd be pretty easy to do this if they weren't honest or man in the middle attack the site.
The reason this is newsworthy is because there are some network-facing programs (CGI-based web servers, some SSH configurations) that will set the value of some environment variables to a user-supplied value, which bash will then be executed by bash when that program spawns a new process.
Earlier quoted context omitted.
I'm sorry; perhaps I'm slow. I see the problem, but how can a stranger set an environment variable?
There are a lot of scripts the do something like: curl ' http://myradframework.com/script.sh' | bash That'd be pretty easy to do this if they weren't honest or man in the middle attack the site.
Earlier quoted context omitted.
Yeah, I was current yesterday and I'm current today, with both apt-get update and upgrades. Your version number is lower than mine, you must be on either stable or testing. ii bash 4.3-9 i386 GNU Bourne Again SHell $ env x='() { :;}; echo vulnerable' bash -c "echo this is a test" vulnerable this is a test From the FAQ: > Does sid have security updates? Not in the same sense that stable does. If the maintainer of a pa…
sid/unstable had a fix uploaded ~3 hrs ago fwiw (after you made your comment).
It might still be an issue. The patches may not have done enough. $ env X='() { (a)=>\' sh -c "echo date"; cat echo https://twitter.com/taviso/status/514887394294652929# env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "still vulnerable :("
"still vulnerable :("
It might still be an issue. The patches may not have done enough. $ env X='() { (a)=>\' sh -c "echo date"; cat echo https://twitter.com/taviso/status/514887394294652929# env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "still vulnerable :("
It might still be an issue. The patches may not have done enough. $ env X='() { (a)=>\' sh -c "echo date"; cat echo https://twitter.com/taviso/status/514887394294652929# env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "still vulnerable :("
Chet (bash maintainer) says he has a fix. http://seclists.org/oss-sec/2014/q3/682
Earlier quoted context omitted.
I'm sorry; perhaps I'm slow. I see the problem, but how can a stranger set an environment variable?
In a webserver, like Apache, environment variables are set from headers sent by the client, e.g. each header like Cookie would produce variable like HTTP_COOKIE. These variables can contain any data that the user sent. If Apache uses external code (like PHP, Ruby, Python, etc.) to process the request, it may pass these variables to that code, and if that code runs some command on the system, these variables may be pa…
So they set shell vars without sanitising them first?
Earlier quoted context omitted.
sid/unstable had a fix uploaded ~3 hrs ago fwiw (after you made your comment).
Only for amd64 though, ctrl+f for "4.3-9.1": http://ftp.debian.org/debian/pool/main/b/bash/
Edit: I see that even those who got the patch are in fact still vulnerable.
It might still be an issue. The patches may not have done enough. $ env X='() { (a)=>\' sh -c "echo date"; cat echo https://twitter.com/taviso/status/514887394294652929# env X='() { (a)=>\' bash -c "echo echo vuln"; [[ "$(cat echo)" == "vuln" ]] && echo "still vulnerable :("