SoylentNews is people
SoylentNews
from the he-who-does-not-learn-from-history dept.
David Wheeler has a nice write-up of the many aspects of the shellshock vulnerability in Bash, including a timeline of events and commentary on how to prevent vulnerabilities like shellshock in the future.
He even provides a quick test to see if your shell is still susceptible to shellshock:
To determine if a system is vulnerable to shellshock, run the following refined test on a Unix-like system command line (this should work on any Bourne or C shell):
env foo='() { echo not patched; }' bash -c foo
This will reply “bash: foo: command not found” on a repaired system, while a vulnerable system will typically reply “not patched” instead. The initial “env” can be omitted when typing the command into a POSIX/Bourne shell (including bash, dash, and ash).
The write-up shows that several mis-identifications of the problem were communicated, as well as how multiple solutions were constructed—thanks to the code being open-source.
He also presents a similar type of defect under Microsoft Windows where, in a CMD.EXE window, issuing these commands:
set foo=bar^&ping -n 1 localhost echo %foo%
will not only display the value of the "foo" environment variable, it will also cause a ping command to be executed.
[Update: fixed formatting of code sample.]
(Score: -1, Troll) by Anonymous Coward on Saturday October 11 2014, @03:01PM
This kind of bug can't happen when using C or C++ or Java or C# or any real programming language.
This kind of a bug only happens when using dynamic languages like bash, Ruby, Perl or JavaScript, where code in strings can be executed on the fly.
(Score: 0) by Anonymous Coward on Saturday October 11 2014, @06:38PM
So NO! to $anything because $anything can be used to murder innocents.
Blaming tools for human error is counter productive at best.
(Score: 2, Informative) by Anonymous Coward on Saturday October 11 2014, @07:18PM
if you were serious...type man 3 system. oooo "code in strings can be executed on the fly." that's this very bug, waiting for you to call it from stdlib.
in other words, you have no idea what you're talking about.
(Score: -1, Troll) by Anonymous Coward on Saturday October 11 2014, @11:09PM
Why the fuck is the parent's dumbass comment modded up? It's fucking idiotic.
You have to go to great lengths to execute arbitrary C or C++ code using system(). Fuck, you have to even manually call system() in the first place, and modern compilers warn about its use.
Fuck, all it took with bash was setting and using an environment variable's value! Only somebody as fucking retarded as the parent wouldn't see the difference here.
Mod the parent down. It's full of shit, and it's dumb as rocks.