3 ms·
On most systems I've found this works: LC_TIME='() { :;}; echo vulnerable' ssh <hostname> Not sure of the impact of this, as the user would need to have a r
by adamt 12y ago
On most systems I've found this works:
LC_TIME='() { :;}; echo vulnerable' ssh <hostname>
Not sure of the impact of this, as the user would need to have a remote permissions anyway for the SSH login to occur. But if there was some form of restricted shell that then spawned bash it might potentially create an attack vector.
- MrUnderhill 12y agoI was wondering about this too. My thinking was, if a user's laptop is compromised (and has the exploit in LC_TIME, TERM or similar), and the user then SSH in to a server with exploitable bash, the nefarious command will presumably be executed without the user knowing. But of course, if the laptop is compromised that badly, it could probably wreak havoc to the server anyway.