bugtraq - Re: Bug in bash <= 4.3 [security feature bypassed]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 05 Jun 2014 19:32:36 +0930
From: Daryl Tester <dt-bugtraq@...dcraftedcomputers.com.au>
To: bugtraq@...urityfocus.com
Subject: Re: Bug in bash <= 4.3 [security feature bypassed]

On 03/06/14 23:46, Hector Marco wrote:

> Recently we discovered a bug in bash. After some time after reporting
> it to bash developers, it has not been fixed.

...

> Any comments about this issue are welcomed.
> 
> Details at:
> http://hmarco.org/bugs/bash_4.3-setuid-bug.html

I'm only going by the patch presented above, so ...

1.  The program should be calling setgid() before setuid() (which is
another common class of security mistake).

2.  Why is exit() returning values greater than 255?  It's not capable
of doing that under (most) Unix environments.

-- 
Regards,
  Daryl Tester
  Handcrafted Computers Pty. Ltd.