3 ms·
The point is that, when bash was written, there were few mechanisms for executing code as another user. There were servers/daemons, but they did not execute use
by quesera 12y ago
The point is that, when bash was written, there were few mechanisms for executing code as another user. There were servers/daemons, but they did not execute user code.
Of course some people would pipe to shell in their .forward file and eventually get pwnt, but it was a freshman mistake, and the damage was isolated.
Once you reach the point of executing a shell with an euid other than your own, it's not the shell's job to sanity check your actions.
The web has changed the execution model thoroughly. And people now do lazy things based on their loose understanding of flexible execution models.
This is neither a bug in bash, nor a bug in Apache, etc. It's an integration bug between two complex systems that were designed with zero-to-poor knowledge of each other.
- derekp7 12y agoI'm not quite so sure about that. One of the early examples I've seen of Unix use (I think Ken Thompson was actually in the video, from early 80's) showed using the various tools to process file data that got downloaded from somewhere else (where that data was supposedly created by another user). So if you had a script that did: cat downloaded_file.txt |\ while read inputline do #some processing #call another shell program done In this case, bash would still be vulnerable even without the Internet involved -- just processing a data file you got from Bob in Accounting.
- saurik 12y agoOnly if you not only set a variable to the contents of data from that file, but then also exported that variable to the environment: don't do that (why would you anyway? ;P).