3 ms·
Funny, this works even after bash fix / upgrade env X='() { (a)=>\' sh -c "echo date"; cat e From http://seclists.org/oss-sec/2014/q3/672 http://seclists.org/
by antocv 12y ago
Funny, this works even after bash fix / upgrade
env X='() { (a)=>\' sh -c "echo date"; cat e
From http://seclists.org/oss-sec/2014/q3/672 http://seclists.org/oss-sec/2014/q3/672
- codingbeer 12y agoI can't comprehend how this got buried so fast in the mist of "patch, patch, patch".
- scintill76 12y agoI replaced "sh" with "bash" in the above, and on my patched system it creates a file called "echo" with the date in it. Can anyone explain how this works? Is it an exploit? Edit: From my experiments, the name in (a) doesn't matter, and "echo" and "date" can be changed. The thing in echo's position is where the output goes (and can be an absolute path!), and "date" is a command that is run. Still no idea how it works, as I'm not very familiar with shell syntax and Googling symbols like "=>" is mostly useless. It may even be meaningless and is just garbage to get bash into a state that causes this to happen? Edit 2: http://seclists.org/oss-sec/2014/q3/679 http://seclists.org/oss-sec/2014/q3/679 has a small example. "Tavis and I spent a fair amount of time trying to figure out if this poses a more immediate risk, but so far, no dice. It strongly suggests that the parser is fragile and that there may be unexpected side effects, though"