5 ms·

It's not a complete fix. This still returns 'not patched': foo='() { echo not patched; }' bash -c foo

• dllthomas 12y ago
  Isn't it supposed to? Forbidding child bashes from inheriting exported functions would surely break quite a bit of code.
• scintill76 12y ago
  That could be fixed by this patch[0], which is not official and might break backward compatibility. If you're facing an attacker with arbitrary control of both name and value of environment variables, and shell scripts that don't sanitize, you've got worse problems IMO. Still, some Linux distributions are applying this unofficial patch, to only parse function definitions in prefixed environment variables to mitigate the threats. [0] http://www.openwall.com/lists/oss-security/2014/09/25/13 http://www.openwall.com/lists/oss-security/2014/09/25/13
  • phs2501 12y ago
    The namespace change is an official patch now: https://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027 https://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027
    • dllthomas 12y ago
      Ah, that seems a good way of going about it.