Bugtraq: Re: BUG in /bin/bash

[Dan_Thorson () notes seagate com (Dan Thorson)]

I've tried Solaris 2.5 (unpatched) with the same results.  I'll report on 2.5
using recommended patches if I see anything different.

> Solaris 2.4
> Debian linux 1.1
> Irix 5.2
> OSF/1 3.2
> SunOS 4.1.1
> Ultrix 4.2
> Roger Espel Llima wrote:
> > > > VULNERABILITY:  A variable declaration error in "bash" allows the
character
> > > >                 with value 255 decimal to be used as a command separator.
> >   That reminds me of a similar "little-known feature" on SunOS and
> > Solaris, where /bin/sh interprets '^' as a synonym for '|' :
> >
> > $ sh -c 'echo blah ^ cat'
> > blah
.>   Again this could be exploited to fool CGI scripts (and ircII scripts
> > too) which execute shell commands with user-supplied data, after
> > checking for things like ';', '|' and '&'.