> Tim <mailto:tim-secur...@sentinelchicken.org> > Thursday, September 25, 2014 1:06 PM > > > If you change the default shell from bash to a more sane one[1], like > dash or ash, does this attack disappear?
no. the problem occurs when /bin/sh is bash, or when a network invokable script begins with the line #!/bin/bash. it has nothing to do with the user's shell. rather, it's the shell used by popen() and system() and of course (execl, execlp, execle, execv, execvp, execvpe), or, it's the explicitly called shell named at the top of the script itself. > I would assume so, but > sometimes foolish packages directly reference /bin/bash in the #! > header. (I notice some dhclient shell script hooks don't make an > explicit reference at all, while others reference /bin/sh.) some scripts really do depend on bash's extensions. the dhclient hook is particularly bad about that, since it uses the environment to pass parameters that are set by the DHCP server (or a miscreant pretending to be one). -- Paul Vixie _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
