Re: Re: CVE-2014-6271: remote code execution through bash (3rd vulnerability)

[Chet Ramey <chet.ramey () case edu>]

On 9/29/14, 9:01 AM, Osmond Sun wrote:
> I found the function parsing is still imperfect.
> e.g. $env x="() { :;}; `touch vulnerablefile`" bash -c "echo this is a test "

If that is the command you ran, this doesn't show any vulnerability.  The
double quotes surrounding the assignment to x in the argument to `env'
mean that command substitution is performed before env runs.  It's the
command substitution that creates the file, so the file exists before bash
is invoked.

Chet
-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet () case edu    http://cnswww.cns.cwru.edu/~chet/