Re: CVE-2014-6271: remote code execution through bash

[Florian Weimer <fweimer () redhat com>]

On 09/24/2014 04:05 PM, Florian Weimer wrote:
> Stephane Chazelas discovered a vulnerability in bash, related to how
> environment variables are processed: trailing code in function
> definitions was executed, independent of the variable name.

It was pointed out to me off-list that a patched bash will still import 
functions from the environment, including from variable names which 
override shell commands.  This is not an immediate vulnerability because 
it requires setting environment variables under *specific* names.  If 
you can do that, there are already many variables which can affect the 
execution of shell scripts, and some of them offer direct code execution 
because they are subject to command substitution (BASH_ENV, for 
example).  The current vulnerability mainly exists because the name of 
the environment variable does not matter at all.

My main concern with the current patch is that still exposes the bash 
parser and function definition printer to attacks from the network. Bugs 
in those fairly large components could cause another critical issue.

For hardening against such issues, I proposed a separate environment 
variable with a well-known name, say BASH_FUNCDEFS, which lists the 
names of environment variables which are to be imported as functions. 
This would bring the attack requirements to the level which we have with 
BASH_ENV now.

Removing the functionality completely is difficult because it is 
actually used (search for “export -f”).

(If you find additional bugs, please do not discuss them here, but 
follow the usual disclosure procedures.  Thanks.)

--
Florian Weimer / Red Hat Product Security